Indexing/Searching "complex" JSON in elasticsearch

Question

I have some JSON that looks like the following: Let's call that field metadata

{ 
  "somekey1": "val1",
  "someotherkey2": "val2",
  "more_data": { 
    "contains_more": [
      { 
        "foo": "val5",
        "bar": "val6"
      },
      { 
        "foo": "val66",
        "baz": "val44"
      },
    ],
    "even_more": {
      "foz" : 1234,
    }
  }
}

This is just a simple example. The real one can grow even more complex. Keys can come up multiple times. Values as well and can be int or str.

Now the first problem is that I'm not quite sure how I have to correctly index this in elasticsearch so I can find something with specific requests.

I am using Django/Haystack where the index looks like this:

class FooIndex(indexes.SearchIndex, indexes.Indexable):
    text = indexes.CharField(document=True, use_template=True)
    metadata = indexes.CharField(model_attr='get_metadata')
    # and some more specific fields

And the template:

{
    "foo": {{ object.foo }},
    "metadata": {{ object.metadata}},
    # and some more
}

The metadata will then be filled with the sample above and the result will look like this:

  {
    "foo": "someValue",
    "metadata": { 
      "somekey1": "val1",
      "someotherkey2": "val2",
      "more_data": { 
        "contains_more": [
          { 
            "foo": "val5",
            "bar": "val6"
          },
          { 
            "foo": "val66",
            "baz": "val44"
          },
        ],
        "even_more": {
          "foz" : 1234,
        }
      }
    },
  }

Which will go into the 'text' column in elasticsearch.

So the goal is now to be able to search for things like:

• foo: val5
• foz: 12*
• bar: val*
• somekey1: val1
• and so on

The second problem: When I search e.g. for foo: val5 it matches all objects that just have the key "foo" and all objects that have the val5 somewhere else in it's structure.

This is how I search in Django:

self.searchqueryset.auto_query(self.cleaned_data['q'])

Sometimes the results are "okayish" sometime it's just completely useless.

I could need a pointer in the right direction and get to know the mistakes I made here. Thank you!

Edit: I added my final solution as an answer below!

Answer 1

The one thing that is certain is that you first need to craft a custom mapping based on your specific data and according to your query needs, my advice is that contains_more should be of nested type so that you can issue more precise queries on your fields.

I don't know the exact names of your fields, but based on what you showed, one possible mapping could be something like this.

{
  "your_type_name": {
    "properties": {
      "foo": {
        "type": "string"
      },
      "metadata": {
        "type": "object",
        "properties": {
          "some_key": {
            "type": "string"
          },
          "someotherkey2": {
            "type": "string"
          },
          "more_data": {
            "type": "object",
            "properties": {
              "contains_more": {
                "type": "nested",
                "properties": {
                  "foo": {
                    "type": "string"
                  },
                  "bar": {
                    "type": "string"
                  },
                  "baz": {
                    "type": "string"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Then, as already mentioned by mark in his comment, auto_query won't cut it, mainly because of the multiple nesting levels. As far as I know, Django/Haystack doesn't support nested queries out of the box, but you can extend Haystack to support it. Here is a blog post that explains how to tackle this: http://www.stamkracht.com/extending-haystacks-elasticsearch-backend. Not sure if this helps, but you should give it a try and let us know if you need more help.

Answer 2

Indexing :

First of all you should use dynamic templates, if you want to define specific mapping relatively to key name, or if your documents do not have the same structure.

But 30 key isn't that high, and you should prefer defining your own mapping than letting Elasticsearch guessing it for you (in case incorrect data have been added first, mapping would be defined according to these data)

Searching:

You can't search for

foz: val5

since "foz" key doesn't exist.

But key "metadata.more_data.even_more.foz" does => all your keys are flatten from the root of your document

this way you'll have to search for

foo: val5
metadata.more_data.even_more.foz: 12*
metadata.more_data.contains_more.bar: val*
metadata.somekey1: val1

Using query_string for example

"query_string": {
    "default_field": "metadata.more_data.even_more.foz",
    "query": "12*"
}

Or if you want to search in multiple fields

"query_string": {
    "fields" : ["metadata.more_data.contains_more.bar", "metadata.somekey1"],
    "query": "val*"
}