How do I query an Elasticsearch nested document within an inner object?

Question

I'm trying to filter on a field within a nested document in an Elasticsearch query (ES 5.6.2). The nested document is itself a field within an inner object of the main document. The mapping looks like this:

{
    "mappings": {
        "container": {
            "properties": {
                "host": {
                    "properties": {
                        "tags_nested": {
                            "type": "nested",
                            "properties": {
                                "tag_key": {
                                    "type": "keyword"
                                },
                                "tag_val": {
                                    "type": "keyword"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

I want to filter on host.tags_nested.tag_keys , but I can't figure out the right syntax to access the nested tags_nested document within the host inner object. I tried the following query, which doesn't return any results, when I know there are some that should match:

{
    "query": {
        "nested": {
            "path": "host.tags_nested",
            "query": {
                "bool": {
                    "filter": [
                        {
                            "term": {
                                "host.tags_nested.tag_key": "example_key"
                            }
                        }
                    ]
                }
            }
        }
    }
}

According to the ES docs , you can do a nested query to query within a nested doc, by passing a path which corresponds to the field name of the nested doc. But this seems not to work when the path is within an inner object and needs to be accessed using dot notation.

Any ideas?

Answer 1

Try this. Term Query searches for exact words which we specify. So, for that use fieldname.keyword because keyword stores exact text as we index them.

{
    "query": {
        "nested": {
            "path": "host.tags_nested",
            "query": {
                "bool": {
                    "filter": [
                        {
                            "term": {
                                "host.tags_nested.tag_key.keyword": "example_key"
                            }
                        }
                    ]
                }
            }
        }
    }
}