Elasticsearch query_string search complex keyword by its terms

Question

Now, I know that keyword is not supposed to comprise unstructured text, but let's say that for some reason it just so happened that such text was written into keyword field. When searching such documents using match or term queries, the document is not found, but when searched using query_string the document is found by a partial match(a "term" inside keyword). I don't understand how this is possible when the documentation for Elasticsearch clearly states that keyword is inverse-indexed as is, without terms tokenization. Example: My index mapping:

PUT my_index
{
  "mappings": {
    "my_type": {
      "properties": {
        "full_text": {
          "type":  "text" 
        },
        "exact_value": {
          "type":  "keyword" 
        }
      }
    }
  }
}

Then I put a document in:

PUT my_index/my_type/2
{
  "full_text":   "full text search", 
  "exact_value": "i want to find this trololo!"  
}

And imagine my surprise when I get a document by keyword term, not a full match:

GET my_index/my_type/_search
{
  "query": {
    "match": {
      "exact_value": "trololo" 
    }
  }
}

- no result;

GET my_index/my_type/_search
{
  "query": {
    "term": {
      "exact_value": "trololo" 
    }
  }
}

- no result;

POST my_index/_search
{"query":{"query_string":{"query":"trololo"}}}

- my document is returned(!):

       "hits": {
      "total": 1,
      "max_score": 0.27233246,
      "hits": [
         {
            "_index": "my_index",
            "_type": "my_type",
            "_id": "2",
            "_score": 0.27233246,
            "_source": {
               "full_text": "full text search",
               "exact_value": "i want to find this trololo!"
            }
         }
      ]
   }

user3775217 user3775217 · Accepted Answer · 2017-07-21T09:25:43

when you do a query_string query on elastic like below

POST index/_search
{
    "query": {
        "query_string": {
            "query": "trololo"
        }
    }
}

This actually do a search on _all field which if you don't mention get analyzed by standard analyzer in elastic.

If you specify the field in query like the following you won't get records for keyword field.

POST my_index/_search
{
  "query": {
    "query_string": {
      "default_field": "exact_value", 
      "query": "field"
    }
  }
}

Elasticsearch query_string search complex keyword by its terms

1 Answers