弹性搜索 REST 查询返回超出预期

Question

In order to search for the exact string: "AGA>23/180@20210212" I've tried the below match queries:

{"query": { "match" : {"mid": "AGA>23/180@20210212"}}}
{"query": {"bool": { "must" : [ { "match" : { "mid": "AGA>23/180@23221"}}]}}}

elastic search matches on "AGA>135/880@20210212" & "AGA>212/880@20210212"

So it seems the values 135 & 212 are treated like wildcards.

If I use query instead: {"query": { "term": {"mid": "AGA>23/180@20210212"}}} then 0 results are returned.

How to search for value "AGA>23/180@20210212" only?

Answer 1

The term query returns documents that contain an exact term in a provided field.

By default standard analyzer is used. It will provide grammar based tokenization for AGA>23/180@20210212 and will generate the following tokens.

aga , 23 , 180 , 20210212

Due to this, the match query matches on "AGA>135/880@20210212" & "AGA>212/880@20210212"

To search for the exact term you need to add.keyword to the mid field (if you have not explicitly defined any mapping for the field). This uses the keyword analyzer instead of the standard analyzer (notice the ".keyword" after mid field). Try out this below query -

{
  "query": {
    "term": {
      "mid.keyword": "AGA>23/180@20210212"
    }
  }
}

OR you can change your index mapping to

{
  "mappings": {
    "properties": {
      "mid": {
        "type": "keyword"
      }
    }
  }
}