elasticsearch different result of browser and php client for same query

Question

I run this query below and check the result in returns 144 records, but when I run the query with browser it returns nothing. I know the results must be same in any case this api converts the query like that anyway but results are different and cant understand reason

$elasticSearch = new Elasticsearch\Client(['hosts' => ['localhost:9200']]);
        $params = array();
        $json = '{
                    "query" : {
                        "match" : {
                            "logdata" : "_client_"
                        }
                    }
                    }';
        $params['body'] = $json;
        $params['index'] = 'accesslog_index';
        $params['size'] = 400;
        $query = $elasticSearch->search($params);

if image doesn't seem: the url in browser: http://localhost:9200/accesslog_index/_search?pretty=true&q=logdata:_client_&size=100 and result:

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 72,
    "max_score" : 1.0,
    "hits" : [ {
      "_index" : "accesslog_index",
      "_type" : "acceslogs_june",
      "_id" : "AU6R267Wy2aRfwCng6-y",

...

Answer 1

The main reason for this is because the two queries are not equivalent.

In the query DSL, the equivalent query for http://localhost:9200/accesslog_index/_search?q=logdata:*_client_* is not a match query but a query_string query, like this:

{
    "query": {
        "query_string" : {
            "default_field" : "logdata",
            "query" : "*_client_*"
        }
    }
}

From the official doc:

The query string “mini-language” is used by the Query String Query and by the q query string parameter in the search API.