Inconsistent behavior of ElasticSearch not_analyzed field

Question

I am using ES version 2.3. I have index some documents which have the structure like this :

{
"BUSINESSLINE" :"ABC CORP",
"NAME" : "John"
....
...
}

The field BUSINESSLINE is not_analyzed string.

The problem is that this query returns results :

 {
      "query": {
        "multi_match" : {
          "query":    "ABC", 
          "fields": [ "_all" ] 
        }
      }
    }

But this one does not (It shows no hits!):

{
      "query": {
        "multi_match" : {
          "query":    "ABC", 
          "fields": [ "BUSINESSLINE " ] 
        }
      }
    }

Any help is appreciated, I tried to google and research but I am not able to able find any reason for this. Thanks!

Can you check whether any other field in the document contains this(ABC or abc or Abc) word? — avr
No, it matches on BUSINESSLINE, i cannot share the _source here, but I can clearly see that it matches on "BUSINESSLINE" — Raman S

avr avr · Accepted Answer · 2017-03-02T17:29:24

Yes, you are correct. The query matches the document because of _all filed which is a big string constructed by concatenating all fields by the space separator. And it is also analysed which is why your query is being matched.

You can read more about it here.

Inconsistent behavior of ElasticSearch not_analyzed field

1 Answers