2

I am using a Kibana query

GET /MY_INDEX_HERE/_search
{
  "query": {
    "match": {
      "AccountId": 
        "bc73afda-d4f2"
      
    }
  }
}

and it is giving me the results, I expect. But when I use a terms query, it is not showing any result, although the values are same. There is no difference in any character or any case, everything is lower-case only.

My final goal is to get the result in my C# code. My query is

.Query(q => q.Raw(strQuery) && q.Terms(c => c.Name("by_account").Field(p => p.AccountsList).Terms(accountTerms))

With this query I am getting zero results, but if I comment the second query I am getting results:

.Query(q => q.Raw(strQuery) //&& q.Terms(c => c.Name("by_account").Field(p => p.AccountsList).Terms(accountTerms))

Right now my

strQuery ={\"bool\":{\"must\":[{\"match_phrase_prefix\":{\"fullname\":\"test\"}}]}}

and

  List<string> accountTerms = new List<string>();
                accountTerms.Add("bc73afda-d4f2");

The AccountId is a GUID type, I cant paste the full value here, hence it's not a complete value.

buddemat
  • 4,552
  • 14
  • 29
  • 49
Code Noob
  • 51
  • 6

2 Answers2

1

I assume that your data is stored in a text field, which is an analyzed field type.

If you are using the standard analyzer, your source bc73afda-d4f2 is transformed into the two tokens bc73afda and d4f2. Therefore, if you're querying for the term bc73afda-d4f2 there is no token that matches .

You have different options now, depending on what you want to achieve exactly and which parts you can influence (Elasticsearch and/or C# code).

  1. You could edit your second query to use match_phrase instead of term.

  2. You could add your second condition to the existing strQuery. That would be something along the lines of:

    \"bool\":{\"must\":[{\"match_phrase_prefix\":{\"fullname\":\"test\"}},{\"match_phrase\":{\"AccountId\":\"bc73afda-d4f2\"}}]}}

  3. If your mapping is a multi-type text/keyword field or you can make it into one (or just use a keyword field instead of text), you can query the AccountId.keyword field with your terms query. keyword fields are not analyzed, so the term query for bc73afda-d4f2 would be a hit.

  4. You could use a custom analyzer and reindex your data. But this is probably overkill/the wrong way to approach your issue.

buddemat
  • 4,552
  • 14
  • 29
  • 49
  • then what should i do ? – Code Noob Feb 19 '23 at 12:18
  • What do you want to achieve? Please update your question to include sample data, the field types and an explicit question. With the information given so far, I'd say: just use a `search` query. – buddemat Feb 19 '23 at 12:40
  • yes you are correct, i just tried now, if i am using bc73afda with term it is showing the value, now how can i solve this ? – Code Noob Feb 19 '23 at 12:40
  • .Query(q => q.Raw(strQuery) && q.Terms(c => c.Name("by_account").Field(p => p.AccountsList).Terms(accountTerms)) this is my query in c# code i want results, but i am getting zero results becuase of the account filed, but if i comment the second query then it is giving result – Code Noob Feb 19 '23 at 12:42
  • Again: please edit the question to add the missing information. We still do not know what the data looks like, especially what the field type is. You will have to provide the necessary information if you want people to help you. – buddemat Feb 19 '23 at 12:45
  • @buddemet, i have provided, sorry for that, i am new to stackover na thats why i am like a noob – Code Noob Feb 19 '23 at 12:46
  • No problem, welcome to stackoverflow! It's just that the answer depends on the exact [Elasticsearch field type](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html) and whether it is maybe a mutlifield. Could you please add the part of the mapping that describes the field `AccountId`? I am not aware of an Elasticsearch type `GUID`... – buddemat Feb 19 '23 at 13:09
  • You can get your mapping with `GET /MY_INDEX_HERE/_mapping`. – buddemat Feb 19 '23 at 13:18
1

Troubleshooting Kibana 'terms' Query

The terms query is an exact match query, which means it doesn't analyze the query input or the field values before matching them.

If the AccountId field in your index has been mapped as a keyword field or a text field with the keyword type, then the input bc73afda-d4f2 will be treated as a single term, and it will only match if the field value is an exact match, including case.

Check the mapping of the AccountId:

GET /MY_INDEX_HERE/_mapping/field/AccountId

If the type of the field is text or keyword, Adjust your query to use the exact case and value of the field.

Alternatively, you can use a match_phrase query instead of the terms query to match the exact phrase of the AccountId field, regardless of the case.

GET /MY_INDEX_HERE/_search
{
  "query": {
    "match_phrase": {
      "AccountId": "bc73afda-d4f2"
    }
  }
}
Jinna Balu
  • 6,747
  • 38
  • 47