How to filter data by field that contains specific string in ElasticSearch, Node Js?

Question

I have simple Node Js application.

I want get filtered data by Path field, that contains ' get ' word.

For example my data is like below:

"_source": {
    "time": "2020-03-12T01:25:41.61836-07:00",
    "level": "Info",
    "info": {
      "IpAddress": "0.0.0.0",
      "Path": "/api/test/getTest/1",
      "QueryString": "",
      "UserAgent": "",
      "LogDate": "2020-03-12T08:25:41.6220806Z",
      "Username": "cavidan.aliyev",
      "NodeId": "123456"
    }

In other words my entity object's structure like as below:

{
   time,
        level,
        info: {
          IpAddress,
          Path,
          QueryString,
          UserAgent,
          LogDate,
          Username,
          NodeId
        }
}

My query is like below:

 client.search({
                index: collectionName,
                body: { 
                    from: (params.currentPage - 1) * params.pageSize,
                    size: params.pageSize,
                    "query": {
                        "bool": {
                            "must": mustArr,
                            "filter": [ 
                                {
                                   "match_all": {}
                                }
                            ]
                        }
                    }
                }
            }, function (err, res) {
                if (err) { 
                    reject(err);
                }
                else { 
                    let result = res.hits.hits. map(x => x._source);
                    resolve(result);
                }
            });

How I can filter data by Path field, that contains ' get ' word?

Please help me, thanks

Answer 1

You can make use of Wildcard Query inside the filter query you have. I'm assuming that you are making use of Standard Analyzer for info.Path field.

Note that for the sake of simplicity I've just mentioned what should be going inside the filter query you have.

If info.Path is nested type:

POST <your_index_name>/_search
{
  "query": {
    "bool": {
      "filter": {                        <--- Note this
        "nested": {
          "path": "info",
          "query": {
            "wildcard": {
              "info.Path": {
                "value": "*get*"
              }
            }
          }
        }
      }
    }
  }
}

If info.Path is object type:

POST <your_index_name>/_search
{
  "query": {
    "bool": {
      "filter": {                        <--- Note this
        "wildcard":{
          "info.Path": "*get*"
        }
      }
    }
  }
}

Important Note: Wildcard search slows the query performance, and if you have a control on the Elasticsearch's index, then you should definitely look at ngram search model, which creates n-gram tokens at index-time as mentioned in this link.

Let me know if this helps!

Answer 2

If you don't want returned data with "get" keywords, your wildcard should type into the must_not . For example:

POST <your_index_name>/_search
 {
   "query": {
     "bool": {
       "must_not":{
          "filter": {                       
             "wildcard":{
               "info.Path": "*get*"
              }
           }
        }
     }
  }
}