ElasticSearch query for uuid field-CodePudding

I want to query elasticsearch records where one field contains the uuid values in string format. Here is the record structure

{
"field1": "test 1",
"field2": "testing 1",
"field3": "c48718a5-d715-4fbd-8a53-40707c83b2ce.eb47d75e-6b2f-403c-9e56-f1569d5b40d0"
},
{
"field1": "test 2",
"field2": "testing 2",
"field3": "c48718a5-d715-4fbd-8a53-40707c83b2ce.eb47d75e-6b2f-403c-9e56-f1569d5b40d0.d0644d62-f079-46ee-ab98-30d8d16977c2"
}

my query looks like this

{
   "query": {
       "query_string": {
           "query": "(field1:test) AND (field3:c48718a5-d715-4fbd-8a53-40707c83b2ce.eb47d75e-6b2f-403c-9e56-f1569d5b40d0)",
           "default_operator": "and"
       }
   }
}

Here is the mapping for the field3

"field3": {
           "type": "text",
           "fields": {
              "keyword": {
                 "type": "keyword",
                 "ignore_above": 256     
              }
            }
 }

The problem is elasticsearch is sending both the records when i run this query. I only want first record to be fetched. Here elasticsearch is matching the provided string in the field3 but i want the record where field value is equal to the given value.

Please suggest. Thanks.

CodePudding user response：

You are almost there. You just need to use field3.keyword instead of field3. This uses the keyword analyzer instead of the standard analyzer (notice the ".keyword" after field3 field).

Modify your search query as

{
   "query": {
       "query_string": {
           "query": "(field1:test) AND (field3.keyword:c48718a5-d715-4fbd-8a53-40707c83b2ce.eb47d75e-6b2f-403c-9e56-f1569d5b40d0)",
           "default_operator": "and"
       }
   }
}

Also, you can remove the default_operator from the search query, since you have already added AND in the query part.