Elastic search query using python list

Question

How do I pass a list as query string to match_phrase query?

This works:

{"match_phrase": {"requestParameters.bucketName": {"query": "xxx"}}},

This does not:

        {
            "match_phrase": {
                "requestParameters.bucketName": {
                    "query": [
                        "auditloggingnew2232",
                        "config-bucket-123",
                        "web-servers",
                        "esbck-essnap-1djjegwy9fvyl",
                        "tempexpo",
                    ]
                }
            }
        }

Have to tried using `bool` query ? Ref : https://stackoverflow.com/a/30020384/11774805 — Kashyap KN, Jul 25 '20 at 17:24
My question is, does match_phrase supports list like this: {"match_phrase": {"text": ["St Peter Fm", "Cape Basin"]}} ? Something like multi_match but for search term instead of fields. — shantanuo, Jul 25 '20 at 17:38
Using "query_string" is a good workaround. My question is why "match_phrase" does not support a list? — shantanuo, Jul 28 '20 at 01:53
Why do you need `match_phrase` if you're only searching a single token? — Val, Jul 28 '20 at 05:55
I am trying to search for 5 bucket names using "OR" parameter. The question is how to keep the query as concise as possible. It will be very useful if elastic supports the syntax shown in the question. — shantanuo, Jul 31 '20 at 05:08
I got that, but `match_phrase` is for matching tokens that follow each other. You're querying individual tokens, so the `terms` query would probably fit your need. — Val, Jan 05 '21 at 14:01

score 2 · Accepted Answer · answered Jan 06 '21 at 18:39

match_phrase simply does not support multiple values.

You can either use a should query:

GET _search
{
  "query": {
    "bool": {
      "should": [
        {
          "match_phrase": {
            "requestParameters.bucketName": {
              "value": "auditloggingnew2232"
            }
          }
        },
        {
          "match_phrase": {
            "requestParameters.bucketName": {
              "value": "config-bucket-123"
            }
          }
        }
      ]
    },
    ...
  }
}

or, as @Val pointed out, a terms query:

{
  "query": {
    "terms": {
      "requestParameters.bucketName": [
        "auditloggingnew2232",
        "config-bucket-123",
        "web-servers",
        "esbck-essnap-1djjegwy9fvyl",
        "tempexpo"
      ]
    }
  }
}

that functions like an OR on exact terms.

I'm assuming that 1) the bucket names in question are unique and 2) that you're not looking for partial matches. If that's the case, plus if there are barely any analyzers set on the field bucketName, match_phrase may not even be needed! terms will do just fine. The difference between term and match_phrase queries is nicely explained here.

Elastic search query using python list

1 Answers1