I have a email elastic search db created uses following mappings for email sender and receipients:

 "mappings": {
   ...
   "recipients": {
      "type": "keyword"
    },
    "sender": {
      "type": "keyword"
    },
    ...

I am given a list of emails and I try to query the emails if the any of the email is either the sender OR recipient. For example, I try to use following query:

{
  "query": {
    "multi_match" : {
      "query":    "[email protected] [email protected]",
      "operator": "OR",
      "fields": [ "recipients", "sender" ],
      "type": "cross_fields"
    }
  }
}

to query the emails if ([email protected] exists in the sender or receipient) OR ([email protected] exists in the sender or receipient). But it doesn't return any result.. (But it do exists)

Does anyone know how to query the emails if any of the email in sender or receipient? Thanks

CodePudding user response：

It's good that you have found the solution, but understanding why multi_match didn't work and why query_string worked, and why you should avoid the query_string if possible important.

As mentioned, in the

Also, your multi_match query didn't work as you provided the two mails input in the same query like [email protected] [email protected] and this term is analyzed depending on the fields analyzer(keyword in your example), So, it would try to find [email protected] [email protected] in your fields, not [email protected] or [email protected].

If you want to use the multi_match, right query would be

{
    "query": {
        "bool": {
            "should": [
                {
                    "multi_match": {
                        "query": "[email protected]",
                        "operator": "OR",
                        "fields": [
                            "recipients",
                            "sender"
                        ],
                        "type": "cross_fields"
                    }
                },
                {
                    "multi_match": {
                        "query": "[email protected]",
                        "operator": "OR",
                        "fields": [
                            "recipients",
                            "sender"
                        ],
                        "type": "cross_fields"
                    }
                }
            ]
        }
    }
}

which returns below documents.

"hits": [
            {
                "_index": "71367024",
                "_id": "1",
                "_score": 0.6931471,
                "_source": {
                    "recipients": "[email protected]",
                    "sender": "[email protected]"
                }
            },
            {
                "_index": "71367024",
                "_id": "2",
                "_score": 0.6931471,
                "_source": {
                    "recipients": "[email protected]",
                    "sender": "[email protected]"
                }
            }
        ]

CodePudding user response：

I think I may find the answer. Using the following query will work:

{
  "query": {
    "query_string" : {
      "query":    "[email protected] OR [email protected]",
      "fields": [ "recipients", "sender" ]
    }
  }