Difference between doc.field_name vs field_name in Elastic Search?

Question

I have a source like this :

{
      "doc" : {
        "questions" : [
          {
            "question" : "Which gold customers in Texas had bank accounts with more than $10 million last year ?",
            "state" : "COMPLETED",
            "tags" : [
              "computer"
            ]
          }
        ]
      }
    }

When I write a query for searching based on state and tag ,the query looks like this ,

 {
  "size": "2000",
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "doc.questions.state": "COMPLETED"
          }
        },
        {
          "match": {
            "doc.questions.tags": "computer"
          }
        }
      ]
    }
  },
  "from": "0",
  "_source": {
    "includes": [
      "doc.questions.question",
      "doc.questions.state",
      "doc.questions.tags"
    ]
  }
}

Why is it required to write doc.questions.tag instead of questions.tags ?

If i remove doc. from any keys, nothing matches

Where is the difference ?

Answer 1

Basically Elasticsearch has two variants of JSON inside a JSON structure i.e. a nested or object type.

In your case it is an object type. You can verify the mapping or in RDBMS terms the schema of that index using

GET <your_index_name>/_mapping

In order to search based on the values of the inner json structure, you need to include the entire path of the field otherwise elasticsearch would treat questions as if its a field outside doc.

So if your JSON structure is as below, it would work by removing doc.

{
   "questions":[
      {
         "question":"Sample Question",
         "state":"Completed",
         "tags":[
            "computer"
         ]
      }
   ]
}

Hope you understand now as why you would not get any results quite simply because your JSON structure for questions starts from doc.

The links I've shared would help you clarify. Hope that helps!