Created an index tr_logintracker in elasticsearch using the below. We are using Elasticsearch version 7.17 We even tried with data type of Integer in place of index

{
  "mappings": {
    "properties": {
      "logintime": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "logouttime": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss"
      },
      "logout": {
        "type": "long"
      },
      "vehicleid": {
        "type": "long"
      },
      "driverid": {
        "type": "long"
      },
      "vehicleownerid": {
        "type": "long"
      }
    }
  }
}

Index is created

{
    "acknowledged": true,
    "shards_acknowledged": true,
    "index": "tr_logintracker"
}

Document is inserted into the index. Same can be seen using

{
    "query": {
        "match_all" : {}
    }
}

Response

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 1,
            "relation": "eq"
        },
        "max_score": 1.0,
        "hits": [
            {
                "_index": "tr_logintracker",
                "_type": "_doc",
                "_id": "6pJHe4QBPiDyvh1VwkiC",
                "_score": 1.0,
                "_source": {
                    "data": {
                        "vehicleownerid": 17,
                        "driverid": 21,
                        "vehicleid": 20,
                        "logintime": "2022-11-15 18:03:29",
                        "logout": 0
                    }
                }
            }
        ]
    }
}

But when the same is queried null result is getting fetched Query

{
  "query": {
    "bool": {
      "must": [
         { "match": { "driverid" : 21 }}
      ]
    }
  }
}

Response

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 0,
            "relation": "eq"
        },
        "max_score": null,
        "hits": []
    }
}

When checked /tr_logintracker/_mapping can see the below. Which does not look correct. The second set of entries is happening when we insert the document into the index.

{
    "tr_logintracker": {
        "mappings": {
            "properties": {
                "data": {
                    "properties": {
                        "driverid": {
                            "type": "long"
                        },
                        "logintime": {
                            "type": "text",
                            "fields": {
                                "keyword": {
                                    "type": "keyword",
                                    "ignore_above": 256
                                }
                            }
                        },
                        "logout": {
                            "type": "long"
                        },
                        "vehicleid": {
                            "type": "long"
                        },
                        "vehicleownerid": {
                            "type": "long"
                        }
                    }
                },
                "driverid": {
                    "type": "long"
                },
                "logintime": {
                    "type": "date",
                    "format": "yyyy-MM-dd HH:mm:ss"
                },
                "logout": {
                    "type": "long"
                },
                "logouttime": {
                    "type": "date",
                    "format": "yyyy-MM-dd HH:mm:ss"
                },
                "vehicleid": {
                    "type": "long"
                },
                "vehicleownerid": {
                    "type": "long"
                }
            }
        }
    }
}

We also tried the option of dynamic mapping - getting the index created by the program which is inserting. Even in that case query is not fetching the result.

CodePudding user response：

Tldr;

It seems you have two entries for driverid,

• data.driverid
• driverid

From the document you showed the first time, you have data.driverid: 21. But you seem to query driverid instead.

Solution

This should work.

{
  "query": {
    "bool": {
      "must": [
         { "match": { "data.driverid" : 21 }}
      ]
    }
  }
}

Root Cause

Most likely, you must be sending a document like below to Elasticsearch

{
  "data": {
    "vehicleownerid": 17,
    "driverid": 21,
    "vehicleid": 20,
    "logintime": "2022-11-15 18:03:29",
    "logout": 0
  }
}

Where as you should be sending it like so

{
  "vehicleownerid": 17,
  "driverid": 21,
  "vehicleid": 20,
  "logintime": "2022-11-15 18:03:29",
  "logout": 0
}

CodePudding user response：

From the match_all result, I can see that what you want to query stays inside the data object. So, instead of matching driverid, it should be data.driverid.

Your query then looks like this:

{
  "query": {
    "bool": {
      "must": [
         { "match": { "data.driverid" : 21 }}
      ]
    }
  }
}