Elastic Search query match on keyword 'OR'-CodePudding

I'm using ElasticSearch 7.0

Given the mapping:

{
  "searchquestion": {
    "mappings": {
      "properties": {
        "server": {
          "properties": {
            "hostname": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            }
          }
        }
      }
    }
  }
}

I have put the following documents into this index:

{
   "server": {
       "hostname": "server1-windows.loc2.uk"
   }      
}
{
   "server": {
       "hostname": "server1-windows.loc2.uk"
   }      
}
{
   "server": {
       "hostname": "server1-linux.loc1.uk"
   }      
}

I would like to query the exact text of the hostname. Luckily, this can be done because there is an additional keyword type field on this field.

Successful query :

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "server.hostname.keyword": {
              "query": "server1-windows.loc2.uk"
            }
          }
        }
      ]
    }
  }
}

However, I would like to extend this query string, to include another hostname to search for. In my results, I expect to have both documents returned.

My attempt:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "server.hostname.keyword": {
              "query": "server1-windows.loc2.uk server1-linux.loc1.uk",
              "operator": "or"
            }
          }
        }
      ]
    }
  }
}

This returns no hits, I suspect because the default analyser is splitting this query up into sections, but I'm actually searching the keyword field which is a full string. I cannot add analyzer: keyword to this query search, as server1-windows.loc2.uk server1-linux.loc1.uk as an exact string won't match anything either.

How can I search for both these strings, as their complete selves?
i.e. "query": ["server1-windows.loc2.uk", "server1-linux.loc1.uk"]

I would also like to use wildcards to match any loc. I would expect "query": ["server1-windows.*.uk"] to match both windows servers, but I get no hits.

What am I missing?

CodePudding user response：

you can use Query_String to get your desired result

Case 1:

Query:

GET server/_search
{
  "query": {
    "query_string": {
      "query": "(server1-windows.loc2.uk) OR (server1-linux.loc1.uk)",
      "default_field": "server.hostname.keyword"
    }
  }
}

Output:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 3,
      "relation": "eq"
    },
    "max_score": 0.9808291,
    "hits": [
      {
        "_index": "server",
        "_id": "3",
        "_score": 0.9808291,
        "_source": {
          "server": {
            "hostname": "server1-linux.loc1.uk"
          }
        }
      },
      {
        "_index": "server",
        "_id": "1",
        "_score": 0.4700036,
        "_source": {
          "server": {
            "hostname": "server1-windows.loc2.uk"
          }
        }
      },
      {
        "_index": "server",
        "_id": "2",
        "_score": 0.4700036,
        "_source": {
          "server": {
            "hostname": "server1-windows.loc2.uk"
          }
        }
      }
    ]
  }
}

Case 2: with wildcard(*)

Query:

GET server/_search
{
  "query": {
    "query_string": {
      "query": "server1-windows.*.uk",
      "default_field": "server.hostname.keyword"
    }
  }
}

Output:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 2,
      "relation": "eq"
    },
    "max_score": 1,
    "hits": [
      {
        "_index": "server",
        "_id": "1",
        "_score": 1,
        "_source": {
          "server": {
            "hostname": "server1-windows.loc2.uk"
          }
        }
      },
      {
        "_index": "server",
        "_id": "2",
        "_score": 1,
        "_source": {
          "server": {
            "hostname": "server1-windows.loc2.uk"
          }
        }
      }
    ]
  }
}