Elastic Search Terms query not giving result but match query is giving

Question

I am using a Kibana query

GET /MY_INDEX_HERE/_search
{
  "query": {
    "match": {
      "AccountId": 
        "bc73afda-d4f2"
      
    }
  }
}

and it is giving me the results, I expect. But when I use a terms query, it is not showing any result, although the values are same. There is no difference in any character or any case, everything is lower-case only.

My final goal is to get the result in my C# code. My query is

.Query(q => q.Raw(strQuery) && q.Terms(c => c.Name("by_account").Field(p => p.AccountsList).Terms(accountTerms))

With this query I am getting zero results, but if I comment the second query I am getting results:

.Query(q => q.Raw(strQuery) //&& q.Terms(c => c.Name("by_account").Field(p => p.AccountsList).Terms(accountTerms))

Right now my

strQuery ={\"bool\":{\"must\":[{\"match_phrase_prefix\":{\"fullname\":\"test\"}}]}} 

and

  List<string> accountTerms = new List<string>();
                accountTerms.Add("bc73afda-d4f2");

The AccountId is a GUID type, I cant paste the full value here, hence it's not a complete value.

Answer 1

Troubleshooting Kibana 'terms' Query

The terms query is an exact match query, which means it doesn't analyze the query input or the field values before matching them.

If the AccountId field in your index has been mapped as a keyword field or a text field with the keyword type, then the input bc73afda-d4f2 will be treated as a single term, and it will only match if the field value is an exact match, including case.

Check the mapping of the AccountId:

GET /MY_INDEX_HERE/_mapping/field/AccountId

If the type of the field is text or keyword, Adjust your query to use the exact case and value of the field.

Alternatively, you can use a match_phrase query instead of the terms query to match the exact phrase of the AccountId field, regardless of the case.

GET /MY_INDEX_HERE/_search
{
  "query": {
    "match_phrase": {
      "AccountId": "bc73afda-d4f2"
    }
  }
}

Answer 2

I assume that your data is stored in a text field, which is an analyzed field type.

If you are using the standard analyzer, your source bc73afda-d4f2 is transformed into the two tokens bc73afda and d4f2. Therefore, if you're querying for the term bc73afda-d4f2 there is no token that matches .

You have different options now, depending on what you want to achieve exactly and which parts you can influence (Elasticsearch and/or C# code).

1. You could edit your second query to use match_phrase instead of term.

2. You could add your second condition to the existing strQuery. That would be something along the lines of:

   \"bool\":{\"must\":[{\"match_phrase_prefix\":{\"fullname\":\"test\"}},{\"match_phrase\":{\"AccountId\":\"bc73afda-d4f2\"}}]}}
   

3. If your mapping is a multi-type text/keyword field or you can make it into one (or just use a keyword field instead of text), you can query the AccountId.keyword field with your terms query. keyword fields are not analyzed, so the term query for bc73afda-d4f2 would be a hit.

4. You could use a custom analyzer and reindex your data. But this is probably overkill/the wrong way to approach your issue.