0

Elastic search below query doesn't return any results:

1.) {"query":{"regexp":{"field_name":".*f04((?!z).)*"}}

Why a query like above doesn't return any result?

I'm expecting results like this : ['f00bar', 'f04bar', 'f04barbuh', 'f04ba']

whereas below one returns:

2.) {"query":{"regexp":{"field_name":".*f04((?!z).)*.*"}}

Results returned by this : ['f04bar', 'f04barbuh', 'f04ba', 'f04baz']

I know that 2nd query returns result because of .* at the end, is there anything wrong with '!' in the regexp, it should be something else? how do we use ! as the part of regexp to specify ba should not be followed by z.

tukan
  • 17,050
  • 1
  • 20
  • 48
zubug55
  • 729
  • 7
  • 27

1 Answers1

0

The regexp query is run against the index which contains the analyzed version of the underlying data. By default the standard analyzer is used which splits text into words (just alphanumeric), removes everything else (here is where ! will get removed) and then lowercases everything.

To see exactly what's happening you can use the _analyze API, to modify that process either map that field as keyword or specify a different analyzer.

Honza Král
  • 2,982
  • 14
  • 11
  • My fields are mapped as keyword only like below: { "field_name1": { "type": "keyword" }, "field_name2": { "type": "keyword" }, "query": { "properties": { "regexp": { "properties": { "field_name1": { "type": "keyword" }, "field_name2": { "type": "keyword" } } } } } } – zubug55 Aug 09 '18 at 21:34