Why my ElasticSearch query does not fetch any records?

Question

I'm running the following query :

{
    "size": 50,
    "_source" : ["servername", "silo", "packages.displayname", "packages.displayversion","environment"],

  "query": {
    "bool": {
      "must": {
        "match": {
          "packages.displayname": "Google Chrome"
        }
      }
      ,
       "must": {
        "type": {
          "value": "server"
        }
      }
    }
  }
}

But it doesn't fetch any records

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 0,
        "max_score": null,
        "hits": []
    }
}

However, the concerned index\type has some records where "packages.displayname" = "Google Chrome", below is a sample of the index\type

{
    "took": 78,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 994,
        "max_score": 1,
        "hits": [
            {
                "_index": "package_conformity-13.02.2019",
                "_type": "server",
                "_id": "AWjklhaPsoJF1yu58sfg",
                "_score": 1,
                "_source": {
                    "environment": "PRD",
                    "servername": "Zephyr",
                    "packages": [
                        {
                            "displayname": "Google Chrome",
                            "displayversion": "71.0.3578.80"
                        },

here is the index mapping :

{
    "package_conformity-13.02.2019": {
        "mappings": {
            "server": {
                "properties": {
                    "environment": {
                        "type": "keyword"
                    },
                    "farm": {
                        "type": "keyword"
                    },
                    "packages": {
                        "type": "nested",
                        "properties": {
                            "InstallDate": {
                                "type": "date",
                                "index": false
                            },
                            "InstallLocation": {
                                "type": "text",
                                "index": false
                            },
                            "comments": {
                                "type": "text",
                                "index": false
                            },
                            "displayname": {
                                "type": "keyword"
                            },
                            "displayversion": {
                                "type": "keyword",
                                "index": false
                            },
                            "publisher": {
                                "type": "text",
                                "index": false
                            },
                            "regkey": {
                                "type": "keyword",
                                "index": false
                            }
                        }
                    },
                    "servername": {
                        "type": "keyword"
                    },
                    "silo": {
                        "type": "keyword"
                    },
                    "timestamp": {
                        "type": "date",
                        "format": "yyyy-MM-dd HH:mm:ss"
                    }
                }
            }
        }
    }
}

Is there something wrong in the way of querying or in the index structure or content ? Please help me by pointing me to the right way..

Thanks

Answer 1

If you want multiple constraints inside your must clause, you need to have an array (and not repeat the must keyword multiple times). Also, the constraint on _type should be made differently, using a term query. Try this query instead:

{
  "size": 50,
  "_source": [
    "servername",
    "silo",
    "packages.displayname",
    "packages.displayversion",
    "environment"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "packages",
            "query": {
              "match": {
                "packages.displayname": "Google Chrome"
              }
            }
          }
        },
        {
          "term": {
            "_type": "server"
          }
        }
      ]
    }
  }
}