Elasticsearch match VS query_string

Question

Here are my tests:

Using match

{"query":{"bool":{"must":[{"match":{"name":{"query":"ka"}}},{"term":{"kind":"k1"}}]}}}

0 hits

Then using query_string

{"query":{"bool":{"must":[{"query_string":{"fields":["name"],"query":"*ka*"}},{"term":{"kind":"k1"}}]}}}

about 1000+ hits
Some names such as "katyperry", "KathleenLights" etc. They can not be found by using match

In addition, another example that make me even have more doubt is, when I use match to search email

{"query": {"bool": {"must": [{ "match":{"email":"[email protected]"}}]}}}

ES returns all emails which contain "gmail.com"

So how "match" works in these cases ?

Jason Rosendale Jason Rosendale · Accepted Answer · 2018-05-31T19:06:13

Your first query returns no results because you aren't using a wildcard search, which you couldn't even if you wanted to because "match" doesn't support wildcards. :) Use this instead:

{"query":{"bool":{"must":[{"wildcard":{"name":"*ka*"}},{"term":{"kind":"k1"}}]}}}

Your last query returns those results because your saving the email as an analyzed string, and the standard analyzer splits strings on whitespace and punctuation. This is a great thing when you index "hello,world" and are able to match on "hello" and "world". But it also means that "[email protected]" is treated as three words -- "testname", "gmail", and "com".

Fixing this problem requires that define "email" to be a nonanalyzed string in your mapping. Unless you're using v5.0 or greater, in which case -- good news! You already have a "keyword" field that is not analyzed and the following query will magically just work for you:

{"query": {"bool": {"must": [{ "match":{"email.keyword":"[email protected]"}}]}}}

Elasticsearch match VS query_string

1 Answers