2
        POST http://localhost:9200/test2/drug?pretty
        {
          "title": "I can do this"
        }


        get test2/drug/_search
        {
          "query" : {
            "match": {
              "title": "cancer"
            }
          }
        }

The mappings are:

        {
           "test2": {
              "mappings": {
                 "drug": {
                    "properties": {
                       "title": {
                          "type": "string"
                       }
                    }
                 }
              }
           }
        }

Running the above query returns the document. I want to understand what elastic is doing behind the scenes? From looking at the output of the default analyzer it does not tokenize cancer such that it returns "can" so why is a document with the word "can" being returned and what is causing this to be returned? In other words, what other processing is happening to the search query "cancer".

Updated

Is there a command I can run on my box that will clear all indexes and everything so I have a clean slate? I ran delete /* which succeeded but still getting a match.

Andrei Stefan
  • 51,654
  • 6
  • 98
  • 89
Imran Azad
  • 1,008
  • 2
  • 12
  • 30
  • Are you sure your document contains only one property title ? – CodeNotFound Nov 11 '15 at 19:55
  • @CodeNotFound It's really bizarre, as far as I'm aware that's all there is. I'm actually just going to run the queries on a "clean" box to see what happens. – Imran Azad Nov 11 '15 at 19:57
  • you are searching on /test2/_search which will retrieve all documents that match in all types in test2 index. Change your url to this => /test2/drug/_search – CodeNotFound Nov 11 '15 at 19:59
  • @CodeNotFound Thanks but I'd already tried that and that didn't work either. :-( – Imran Azad Nov 11 '15 at 20:13

2 Answers2

1

The problem with your test is, if you are using Sense, the get request. In Sense it should be GET (capital letters).

The explanation is related to GET vs. POST http methods. Behind the scene Sense actually converts a GET request to a HTTP POST (given that many browsers do not support HTTP GET requests with a request body). This means that, even if you write GET, the actual http request is a POST.

Because Sense has the autocomplete that forces upper case letters for request methods, it uses the same upper case letters when deciding if it's a GET (and not a lowercase get) request together with a request body. If it is, then that request is transformed to a POST one. If it compares the request method and decides is not a GET it sends the request as is, meaning with a get method and with a body. Since the body is ignored, what reaches Elasticsearch will be a test2/drug/_search which is basically a match_all.

Andrei Stefan
  • 51,654
  • 6
  • 98
  • 89
0

I guess that you configured in your index mappings an NGram filter or tokenizer. Let's suppose (I hope you'll confirm my hypothesis) an Edge NGram is configured. You can check it with:

GET test2/_mapping

Then the document is tokenized: i,c,ca,can,d,do,t,th,thi,this. As a result, in the index, the token can points to the document I can do this

When you're searching cancer, the tokens c,ca,can,canc,cance,cancer are produced by the same analysis chain, and then looked for in the index. As a result your document is found.

With the NGram filter, you often need to configure a different analyzer for search than for indexing, for instance:

  • index_analyzer/analyzer: standard + edge ngram
  • search_analyzer: stardand along

Then if you search can you'll find documents containing can,cancer,candy... But if you search cancer, you'll only find documents containing cancer,cancerology... and so on.

G Quintana
  • 4,556
  • 1
  • 22
  • 23
  • @G Quintana, absolutely I agree with what you are saying however the bizzare thing is there is no ngram filter or tokenizer, I've updated the question to show the mappings. – Imran Azad Nov 11 '15 at 20:11