Searching in the middle of a not_analyzed field

Question

I have an Elasticsearch index where one of the fields is marked with not_analyzed. This field contains a space-separated list of values, like this:

Value1 Value2 Value3

Now I want to perform a search to find documents where this field contains "Value2". I've tested to search using text phrase prefix but a search for "Value2" matches nothing. A search for "Value1" or "Value1 Value2" on the other hand matches. I don't want any fuzzyness in the searching but only exact matches (which is the reason the field was set to not_analyzed).

Is there any way to do a search like this?

From my limited understanding of Elasticsearch, I'm guessing I need to set the field to analyzed using the whitespace analyzer. Is that right?

Answer 1

Correct, using either the Standard or Whitespace Analyzer among others would break the word down into chunks, split by whitespace, commas etc. A simple_query_string query would then match "Value2" no matter of its position in the documents field.

Standard Analyzer will also Lowercase your fields, meaning that only search terms that are lower-case will match.

Answer 2

You could do this using wildcards, it will be an expensive query though. You might will have to set "lowercase_expanded_terms" to false in order to have the match.

When you're searching for "Value2" and you use wildcard the search would be interpreted as "value2" after the lucene parsing.

query_string:Value2* -> ES interpretation value2*

note that it lowercase your search, this is usefull for analyze fields, but in not_analyzed fields you wont have a match (if the original value is in upper case)

the lowercase_expanded_terms prevents this from happening

now if the field is not_analyzed as you said the following query should match your documents

    {          
      "size": 10,          
      "query": {
        "query_string": {    
          "query": "title:*Value2*"              
        }
      }
    }

sorry for the lousy answer.