getting data without matching full string in elastic search query

Question

my data is stored in the elastic search below format

 {
            "_index": "wallet",
            "_type": "wallet",
            "_id": "5dfcbe0a6ca963f84470d852",
            "_score": 0.69321066,
            "_source": {
                "email": "test20011@gmail.com",
                "wallet": "test20011@operatorqa2.akeodev.com",
                "countryCode": "+91",
                "phone": "7916318809",
                "name": "test20011"
            }
        },
        {
            "_index": "wallet",
            "_type": "wallet",
            "_id": "5dfcbe0a6ca9634d1c70d856",
            "_score": 0.69321066,
            "_source": {
                "email": "test50011@gmail.com",
                "wallet": "test50011@operatorqa2.akeodev.com",
                "countryCode": "+91",
                "phone": "3483330496",
                "name": "test50011"
            }
        },
        {
            "_index": "wallet",
            "_type": "wallet",
            "_id": "5dfcbe0a6ca96304b370d857",
            "_score": 0.69321066,
            "_source": {
                "email": "test110021@gmail.com",
                "wallet": "test110021@operatorqa2.akeodev.com",
                "countryCode": "+91",
                "phone": "2744697207",
                "name": "test110021"
            }
        }

The record should not find if we are using below query

   {
    "query": {
        "bool": {
            "should": [
                {
                    "match": {
                        "wallet": {
                            "query": "operatorqa2.akeodev.com",
                             "operator": "and"
                        }
                    }
                },
                {
                    "match": {
                        "email": {
                            "query": "operatorqa2.akeodev.com",
                                "operator": "and"
                        }
                    }
                }
            ]
        }
    }
}

the record should find if I am passing below Query

    {
    "query": {
        "bool": {
            "should": [
                {
                    "match": {
                        "wallet": {
                            "query": "test20011@operatorqa2.akeodev.com",
                             "operator": "and"
                        }
                    }
                },
                {
                    "match": {
                        "email": {
                            "query": "test20011@operatorqa2.akeodev.com",
                                "operator": "and"
                        }
                    }
                }
            ]
        }
    }
}

I have created the index on the email and wallet field. whenever users searching data by email or wallet and I am not sure that whatever string is sending by the user it's email or wallet so I am using bool.

the record should find if a user sends the full Email address or full Wallet Address. Please help me to find a solution

Answer 1

As mentioned by the other community members, when asking questions like this you should specify the version of Elasticsearch you are using and also provide the mapping.

Starting with Elasticsearch version 5 with default mappings you would only need to change your query to query against the exact version of the field rather than the analyzed version. By default Elasticsearch maps strings to a multi-field of type text (analyzed, for full-text search) and keyword (not-analyzed, for exact match search). In your query you would then query against the <fieldname>.keyword-fields:

{
    "query": {
        "bool": {
            "should": [
                {
                    "match": {
                        "wallet.keyword": "test20011@operatorqa2.akeodev.com"
                    }
                },
                {
                    "match": {
                        "email.keyword": "test20011@operatorqa2.akeodev.com"
                    }
                }
            ]
        }
    }
}

If you are on an Elasticsearch version prior to version 5, change the index-property from analyzed to not_analyzed and re-index your data.

Mapping snippet:

{
  "email": {
    "type" "string",
    "index": "not_analyzed"
  }
}

Your query would still not need to use the and-operator. It will look identical to the query I posted above, with the exception that you have to query against the email and wallet-fields, and not email.keyword and wallet.keyword.

I can recommend you the following blog post from Elastic related to that topic: Strings are dead, long live strings!