Elasticsearch query returns strange sorted (score based) result

Question

I'm using Elasticsearch v5.3.2

I have the following mapping:

{
   "mappings":{
      "info":{
         "_all":{
            "enabled": false
         },
         "properties":{
            "info":{
               "properties":{
                  "email":{
                     "doc_values":"false",
                     "fields":{
                        "ngram":{
                           "analyzer":"custom_nGram_analyzer",
                           "type":"text"
                        }
                     },
                     "type":"keyword"
                  }
               }
            }
         }
     }
  },
  "settings":{
      "analysis":{
         "analyzer":{
             "custom_nGram_analyzer":{
                "filter":[
                   "lowercase",
                   "asciifolding",
                   "custom_nGram_filter"
                ],
                "tokenizer":"whitespace",
                "type":"custom"
            }
        },
        "filter":{
            "custom_nGram_filter":{
               "max_gram":16,
               "min_gram":3,
               "type":"ngram"
            }
        }
      }
   }
}

I see very strange results in terms of document scores when I execute the following query:

GET /info_2017_08/info/_search
{
  "query": {
      "multi_match": {
          "query": "hotmail",
          "fields": [
              "info.email.ngram"
          ]
      }
  }
}

It brings the following results:

"hits": {
    "total": 3,
    "max_score": 1.3834574,
    "hits": [
      {
        "_index": "info_2017_08",
        "_type": "info",
        "_id": "AV4uQnCjzNcTF2GMY730",
        "_score": 1.3834574,
        "_source": {
            "info": {
                 "email": "pv53p8vg@gmail.com"
             }
        }
     },
     {
        "_index": "info_2017_08",
        "_type": "info",
        "_id": "AV4uQm93zNcTF2GMY73x",
        "_score": 0.3967861,
        "_source": {
            "info": {            
                "email": "-vb6sbw54@hotmail.com"
            }
        }
     },
     {
         "_index": "info_2017_08",
         "_type": "info",
         "_id": "AV4uQmYbzNcTF2GMY73P",
         "_score": 0.36409757,
         "_source": {
             "info": {
                 "email": "985pu4c.r02a@gmail.com"
             }
         }
     }
  ]
}

Now pay attention to scores. How come the first result has a higher score than the second one if the first one is ...@gmail.com and the second one is ...@hotmail.com, if I have searched for the term "hotmail"?

The second one should match the query with ngrams "mail" and "hotmail", while the first one will match the query only by ngram "mail", so what is the reason for such an outcome?

Thanks in advance.

Answer 1

Elasticsearch calculates scores of a document on each shard independently using TF/IDF statistics. Because of that, if you have two shards with next content:

1. "info.email": "985pu4c.r02a@gmail.com"
2. "info.email": "1085pu4c.r02a@gmail.com", "info.email": "-vb6sbw54@hotmail.com"

Then for your specific query single document from the first shard will have a higher score than any document from the second shard.

You can examine content of each shards using next API call: GET index/_search?preference=_shards:0