elasticsearchlogstashkibanaelasticsearch-5kibana-6

How to write complex DSL query in Elasticsearch?


This is what I have used for creating index in multi field mapping

curl -X PUT http://localhost:9200/mapping_log
{ "mappings":{ "properties":{"data1:{"type": "text","fields":{"keyword":{"type":"keyword"}}}, {"data2":{"type": "text","fields":{"keyword":{"type":"keyword"}}}, {"data3":{"type": "text","fields":{"keyword":{"type":"keyword"}}}, } } }  

This is my data in my elastic search and I want to do search like for example when I search for support I should get values data and server and when I search for developer I should get geo and graph , and I want suggester for data3 like suppose if I enter g then I should get option of graph and geo ,,can someone help me with this ..

{
        "took": 14,
        "timed_out": false,
        "_shards": {
            "total": 1,
            "successful": 1,
            "skipped": 0,
            "failed": 0
        },
        "hits": {
            "total": {
                "value": 4,
                "relation": "eq"
            },
            "max_score": 1,
            "hits": [
                {
                    "_index": "mapping_log",
                    "_type": "properties",
                    "_id": "1",
                    "_score": 1,
                    "_source": {
                        "data1": "support",
                        "data2": "data",
                        "data3": "datapos"
                    }
                },
                {
                    "_index": "mapping_log",
                    "_type": "properties",
                    "_id": "2",
                    "_score": 1,
                    "_source": {
                        "data1": "support",
                        "data2": "server",
                        "data3": "serverpos"
                    }
                },
                {
                    "_index": "mapping_log",
                    "_type": "properties",
                    "_id": "3",
                    "_score": 1,
                    "_source": {
                        "data1": "developer",
                        "data2": "graph",
                        "data3": "graphpos"
                    }
                },
                {
                    "_index": "mapping_log",
                    "_type": "properties",
                    "_id": "4",
                    "_score": 1,
                    "_source": {
                        "data1": "developer",
                        "data2": "geo",
                        "data3": "geopos"
                    }
                }
            ]
        }
    }

Solution

  • You need to use edge_ngram tokenizer along with the source filtering

    Adding a working example with index data (Same as that of question), index mapping, search query and search result

    Index Mapping:

    {
      "settings": {
        "analysis": {
          "analyzer": {
            "my_analyzer": {
              "tokenizer": "my_tokenizer"
            }
          },
          "tokenizer": {
            "my_tokenizer": {
              "type": "edge_ngram",
              "min_gram": 1,
              "max_gram": 10,
              "token_chars": [
                "letter",
                "digit"
              ]
            }
          }
        }
      },
      "mappings": {
        "properties": {
          "data1": {
            "type": "text"
          },
          "data2": {
            "type": "text"
          },
          "data3": {
            "type": "text",
            "analyzer":"my_analyzer"
          }
        }
      }
    }
    

    Search Query:

    when I search for support I should get values data and server

    {
      "_source": [
        "data2"
      ],
      "query": {
        "multi_match": {
          "query": "support",
          "fields": [
            "data1",
            "data2"
          ]
        }
      }
    }
    

    Search Result:

    "hits": [
          {
            "_index": "67260491",
            "_type": "_doc",
            "_id": "1",
            "_score": 1.4094054,
            "_source": {
              "data2": "server"
            }
          },
          {
            "_index": "67260491",
            "_type": "_doc",
            "_id": "4",
            "_score": 0.44183272,
            "_source": {
              "data2": "data"
            }
          }
        ]
    

    Search Query:

    {
      "_source": [
        "data2"
      ],
      "query": {
        "multi_match": {
          "query": "developer",
          "fields": [
            "data1",
            "data2"
          ]
        }
      }
    }
    

    Search Result:

     "hits": [
          {
            "_index": "67260491",
            "_type": "_doc",
            "_id": "2",
            "_score": 1.0296195,
            "_source": {
              "data2": "graph"
            }
          },
          {
            "_index": "67260491",
            "_type": "_doc",
            "_id": "3",
            "_score": 1.0296195,
            "_source": {
              "data2": "geo"
            }
          }
        ]
    

    Search Query:

    I want suggester for data3 like suppose if I enter g then I should get option of graph and geo

    {
      "_source": [
        "data3"
      ],
      "query": {
        "match": {
          "data3": "g"
        }
      }
    }
    

    Search Result:

    "hits": [
          {
            "_index": "67260491",
            "_type": "_doc",
            "_id": "3",
            "_score": 1.1123568,
            "_source": {
              "data3": "geopos"
            }
          },
          {
            "_index": "67260491",
            "_type": "_doc",
            "_id": "2",
            "_score": 0.99270093,
            "_source": {
              "data3": "graphpos"
            }
          }
        ]
    

    Update 1:

    You can update the index mapping as

    PUT /<index-name>/_mapping
    
    {
      "properties": {
        "data2": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword"
            }
          }
        }
      }
    }