escaping - Elastic Search Hyphen issue with term filter

Question

I have the following Elastic Search query with only a term filter. My query is much more complex but I am just trying to show the issue here.

{
    "filter": {
            "term": {
                    "field": "update-time"
                }
        }
}

When I pass in a hyphenated value to the filter, I get zero results back. But if I try without an unhyphenated value I get results back. I am not sure if the hyphen is an issue here but my scenario makes me believe so.

Is there a way to escape the hyphen so the filter would return results? I have tried escaping the hyphen with a back slash which I read from the Lucene forums but that didn't help.

Also, if I pass in a GUID value into this field which is hyphenated and surrounded by curly braces, something like - {ASD23-34SD-DFE1-42FWW}, would I need to lower case the alphabet characters and would I need to escape the curly braces too?

Thanks

Answer 1

I would guess that your field is analyzed, which is default setting for string fields in elasticsearch. As a result, when it indexed it's not indexed as one term "update-time" but instead as 2 terms: "update" and "time". That's why your term search cannot find this term. If your field will always contain values that will have to be matched completely as is, it would be the best to define such field in mapping as not analyzed. You can do it by recreating the index with new mapping:

curl -XPUT http://localhost:9200/your-index -d '{
    "mappings" : {
        "your-type" : {
            "properties" : {
                "field" : { "type": "string", "index" : "not_analyzed" }
            }
        }
    }
}'

curl -XPUT  http://localhost:9200/your-index/your-type/1 -d '{
    "field" : "update-time"
}'

curl -XPOST http://localhost:9200/your-index/your-type/_search -d'{
    "filter": {
        "term": {
                "field": "update-time"
        }
    }
}'

Alternatively, if you want some flexibility in finding records based on this field, you can keep this field analyzed and use text queries instead:

curl -XPOST http://localhost:9200/your-index/your-type/_search -d'{
    "query": {
        "text": {
                "field": "update-time"
        }
    }
}'

Please, keep in mind that if your field is analyzed then this record will be found by searching for just word "update" or word "time" as well.