How to query for * value in Elastic Nested Query?

Question

I have documents with nested entries like this:

"listOfElements": {
    "entries": [{
            "key1": "value1",
            "key2": "value2"
        }, {
            "key1": "value3",
            "key2": "*"
        }
    ]
}

Thus the * in the second entry is an actual String value, not a wildcard.

Now I'm trying to query all documents with key1:value3 and key2:* using the following body:

{
    "query": {
        "nested" : {
            "path" : "listOfElements.entries",
            "score_mode" : "avg",
            "query" : {
                "bool" : {
                    "must" : [
                    { "match" : {"listOfElements.entries.key1" : "value3"} },
                    { "match" : {"listOfElements.entries.key2" : "*" } }
                    ]
                }
            }
        }
    }
}

However, this doesn't return any documents at all.

Also, using "\\*" as query parameter for key2 doesn't help.

Is it even possible to query for * as an actual String value and not as wildcard?

EDIT after 1st answer with hint to Analyzer settings: Tried to configure my index to use a mapping char_filter as described in the Elastic docs:

"settings": {
    "analysis": {
        "analyzer": {
            "rebuilt_standard": {
                "tokenizer": "standard",
                "char_filter": [
                    "replace_star_filter"
                ]
            }
        },
        "char_filter": {
            "replace_star_filter": {
                "type": "mapping",
                "mappings": [
                    "* => _star_"
                ]
            }
        }
    }
}

This works if I call the analyze URL manually, e.g. with this body

{
  "analyzer": "rebuilt_standard",
  "text": "I'm delighted about it *"
}

I get the following response:

{
    "tokens": [
        {
            "token": "I'm",
            "start_offset": 0,
            "end_offset": 3,
            "type": "<ALPHANUM>",
            "position": 0
        },
        {
            "token": "delighted",
            "start_offset": 4,
            "end_offset": 13,
            "type": "<ALPHANUM>",
            "position": 1
        },
        {
            "token": "about",
            "start_offset": 14,
            "end_offset": 19,
            "type": "<ALPHANUM>",
            "position": 2
        },
        {
            "token": "it",
            "start_offset": 20,
            "end_offset": 22,
            "type": "<ALPHANUM>",
            "position": 3
        },
        {
            "token": "_star_",
            "start_offset": 23,
            "end_offset": 24,
            "type": "<ALPHANUM>",
            "position": 4
        }
    ]
}

EDIT 2: I finally managed to get this to work. I had to configure the mapping beforehand so that the specific field would use my custom analyzer. The tricky and unexpected thing for me was, that when I ran the search query it would show me the original document with the * inside but if I ran the query from the API using a JSON Body then I could use star and would get a match.

If you need exact match then probably [`term`](https://www.elastic.co/guide/en/elasticsearch/reference/7.0/query-dsl-term-query.html) query is the way to go. To use it you will have to index the field as [`keyword`](https://www.elastic.co/guide/en/elasticsearch/reference/7.0/keyword.html) data type. — Nikolay Vasiliev, Apr 23 '19 at 15:50

score 0 · Accepted Answer · answered Apr 23 '19 at 08:21

Your search syntax is correct, i think the problem lies in the values you are searching for and more accurately which Analyzer your index is using.

i'm assuming you are using the standard analyzer (which your index is defaulted too unless specified differently), basically what this means is that not ALL of your data is index'd just some of it, you should read further about which analyzers do what however if you want to save specific none ALPHANUMERIC characters like * you will have to create a custom analyzer.

TLDR:

Good news yes it is possible, create a custom analyzer that DOES index the special character *. The bad news this means creating a new index from scratch and re-indexing all the data into it.

You can read about how to do it more easily here

How to query for * value in Elastic Nested Query?

1 Answers1

TLDR: