Combine wildcard search & range query in Elasticsearch?

Programming
, , ,
1

I am trying to combine a wildcard search with a date range in an Elasticsearch query, but the response is including items outside of the specified date range.

Index Mapping:

{
  "index_history": {
    "mappings": {
      "applications_datalake": {
        "properties": {
          "query": {
            "properties": {
              "term": {
                "properties": {
                  "server": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                      }
                    }
                  }
                }
              }
            }
          }
        }
      },
      "index-data-type": {
        "properties": {
          "attributes": {
            "properties": {
              "wwnListForServer": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              }
            }
          },
          "hostName": {
            "type": "keyword"
          },
          "requestDate": {
            "type": "date"
          },
          "requestedBy": {
            "properties": {
              "id": {
                "type": "keyword"
              },
              "name": {
                "type": "keyword"
              }
            }
          }
        }
      }
    }
  }
}

Query:

{
  "from": 0,
  "size": 10,
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "should": [
              {
                "wildcard": {
                  "hostName": "*abc*"
                }
              },
              {
                "range": {
                  "requestDate": {
                    "gte": "2019-10-01T08:00:00.000Z"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}

The query is not returning the expected response based on the wildcard search, as it is returning items outside of the specified date range.

2

The issue is that the “hostName” field is in the “index-data-type” mapping, but the query is searching in the “applications_datalake” mapping. To fix the issue, update the query to search in the correct mapping:

{
  "from": 0,
  "size": 10,
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "should": [
              {
                "wildcard": {
                  "attributes.hostName": "*abc*"
                }
              },
              {
                "range": {
                  "requestedBy.id": {
                    "gte": "2019-10-01T08:00:00.000Z"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}