Elastic Search Hyphen issue with term filter

55
votes

I have the following Elastic Search query with only a term filter. My query is much more complex but I am just trying to show the issue here.

{
    "filter": {
            "term": {
                    "field": "update-time"
                }
        }
}

When I pass in a hyphenated value to the filter, I get zero results back. But if I try without an unhyphenated value I get results back. I am not sure if the hyphen is an issue here but my scenario makes me believe so.

Is there a way to escape the hyphen so the filter would return results? I have tried escaping the hyphen with a back slash which I read from the Lucene forums but that didn't help.

Also, if I pass in a GUID value into this field which is hyphenated and surrounded by curly braces, something like - {ASD23-34SD-DFE1-42FWW}, would I need to lower case the alphabet characters and would I need to escape the curly braces too?

Thanks

3
filterescapingelasticsearchterm
I wasted a day only to figure out that the problem of not getting any documents back was not due to a bad query but due to a hyphen in my test example... – Andre Holzner
I wasted two days.... – Brah0um

3 Answers

87
votes

I would guess that your field is analyzed, which is default setting for string fields in elasticsearch. As a result, when it indexed it's not indexed as one term "update-time" but instead as 2 terms: "update" and "time". That's why your term search cannot find this term. If your field will always contain values that will have to be matched completely as is, it would be the best to define such field in mapping as not analyzed. You can do it by recreating the index with new mapping:

curl -XPUT http://localhost:9200/your-index -d '{
    "mappings" : {
        "your-type" : {
            "properties" : {
                "field" : { "type": "string", "index" : "not_analyzed" }
            }
        }
    }
}'

curl -XPUT  http://localhost:9200/your-index/your-type/1 -d '{
    "field" : "update-time"
}'

curl -XPOST http://localhost:9200/your-index/your-type/_search -d'{
    "filter": {
        "term": {
                "field": "update-time"
        }
    }
}'

Alternatively, if you want some flexibility in finding records based on this field, you can keep this field analyzed and use text queries instead:

curl -XPOST http://localhost:9200/your-index/your-type/_search -d'{
    "query": {
        "text": {
                "field": "update-time"
        }
    }
}'

Please, keep in mind that if your field is analyzed then this record will be found by searching for just word "update" or word "time" as well.

33
votes

The accepted answer didn't work for me with elastic 6.1. I solved it using the "keyword" field that elastic provides by default on string fields.

{
    "filter": {
            "term": {
                    "field.keyword": "update-time"
                }
        }
}
1
votes

Based on the answer by @imotov If you're using spring-data-elasticsearch then all you need to do is mark your field as:

@Field(type = FieldType.String, index = FieldIndex.not_analyzed)

instead of

@Field(type = FieldType.String)

The problem is you need to drop the index though and re-instantiate it with new mappings.