Match all values in a nested array using elasticsearch

Question

I am trying to use elasticsearch to match all values in a nested array. For eg. my search array is ["1","2","3","4","5","6","7","8","9"] and my document contains an array of arrays like

"arr":[
["1","2","10"],
["4","5"],
["8","9","11"]
]

I need to match all the values inside a nested array but only one of the nested arrays needs to be a match for the document to be a match. So, in this example only the second nested array is a match because "4" and "5" are both present in the search array (therefore my document is a match). What kind of query should I use to achieve this?

Answer 1

You can get away with a simple Groovy script like this one:

def match = false; 
for (sub_array in _source.arr) {
    match = match || (search_array.intersect(sub_array).size() == sub_array.size())
}
return match;

The idea is to iterate over all arr sub-arrays and check if the intersection with the search array has the same size as the sub-array itself.

Wrapping this inside a script filter, the query would look like this:

POST index/type/_search
{
   "query": {
      "filtered": {
         "filter": {
            "script": {
               "script": "def match = false; for (sub_array in _source.arr) {match = match || (search_array.intersect(sub_array).size() == sub_array.size())}; return match;",
               "params": {
                  "search_array": [ "1", "2", "3", "4", "5", "6", "7", "8", "9" ]
               }
            }
         }
      }
   }
}

You also need to make sure to enable dynamic scripting in order for this to work, i.e. in your elasticsearch.yml file just add script.inline: on and restart your cluster.