Question

I am indexing Elasticsearch documents with a nested field containing another nested field(so 2 step tree for a field). I want to match a document based on the data from inner nested field, which is not working.

NestedFilterBuilder looks like the below one..

        "nested" : {
          "filter" : {
            "or" : {
              "filters" : [ {
                "term" : {
                  "event_attribute_value" : "Obama"
                }
              }, {
                "term" : {
                  "event_attribute_value" : "President"
                }
              } ]
            }
          },
          "path" : "eventnested.attributes"
        }

This is the Java I am using to generate the query

orFilter.add(termFilter("event_attribute_value","president"));
NestedFilterBuilder nestedFilterBuilder = new NestedFilterBuilder("eventnested.attributes", orFilter);
finalFilter.add(nestedFilterBuilder);

Mapping on which the index built is

"eventnested":{
            "type" : "nested", "store" : "yes", "index" : "analyzed", "omit_norms" : "true",
            "include_in_parent":true,
            "properties":{              
                "event_type":{"type" : "string", "store" : "yes", "index" : "analyzed","omit_norms" : "true"},
                "attributes":{
                "type" : "nested", "store" : "yes", "index" : "analyzed", "omit_norms" : "true",
                "include_in_parent":true,
                    "properties":{
                        "event_attribute_name":{"type" : "string", "store" : "yes", "index" : "analyzed","omit_norms" : "true"},
                        "event_attribute_value":{"type" : "string", "store" : "yes", "index" : "analyzed","omit_norms" : "true"}
                    }
                    },
                "event_attribute_instance":{"type" : "integer", "store" : "yes", "precision_step" : "0"}
                }                                           
                }

Is thr something I am using wrong?

Answer 1

According to your mapping event_attribute_value is analyzed. It means that during indexing phrase “President Obama” is analyzed into two tokens: “president” and “obama”. You are searching for the tokens “President” and “Obama” that don’t exist in the index.

You can solve this problem by

1. changing field mapping to not_analyzed,
2. replacing term filter with text query or
3. using correct tokens in your term filter (“president” and “obama” in
   this case).