Search code examples
elasticsearchkibanaelastic-stack

No matches when querying Elastic Search

I'm trying to run a query elastic search. When run this query

GET accounts/_search/
{
  "query": {
   "term": {
     "address_line_1": "1000"
   }
  }
}

I get back multiple records like

    "hits" : [
      {
        "_index" : "accounts",
        "_type" : "_doc",
        "_id" : "...",
        "_score" : 8.355149,
        "_source" : {
          "state_id" : 35,
          "first_name" : "...",
          "last_name" : "...",
          "middle_name" : "P",
          "dob" : "...",
          "status" : "ACTIVE",
          "address_line_1" : "1000 BROADROCK CT",
          "address_line_2" : "",
          "address_city" : "PARMA",
          "address_zip" : "",
          "address_zip_plus_4" : ""
        }
      },

But when I try to expand it to include the more like below I don't get any matches

GET accounts/_search/
{
  "query": {
   "term": {
     "address_line_1": "1000 B"
   }
  }
}

The response is

{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  }
}
Solution

  • The term query is looking for exact matches. Your address_line_* fields were most probably indexed with the standard analyzer which lowercase-s all the letters which in turn prevents the query from matching.

    So either use

    GET accounts/_search/
{
  "query": {
   "match": {                <--
     "address_line_1": "1000 B"
   }
  }
}

    which does not really 'care' about B being lower/upper case or adjust your field analyzers such that the capitalization is preserved.