Query by UUID format-like field on elasticsearch

Question

I've indexed documents like that's been created on the fly, so I mean the mapping has been created on at the same time new fields were created (dynamically).

{
  "user":"living_team",
  "timestamp":"2015-12-14T18:06:47.085Z",
  "matter":"snip2.PNG",
  "comment":"Archive",
  "channel":"Feina",
  "feedTypes":[
     20
  ],
  "property_general_ldate":"2015-12-14T18:06:47.085Z",
  "property_tSize":7595.0,
  "resources":[
     {
        "timestamp":"2015-12-14T16:58:00.598Z",
        "matter":"snip2.PNG",
        "comment":"Archive",
        "channel":"Feina",
        "feedType":20,
        "mime":"image/png",
        "source":{
           "sourceId":{
              "id":"C:\\Users\\Beep\\Desktop\\share\\snip2.PNG",
              "batch":"c38eec2d-a282-11e5-baf4-382c4ab9e433",
              "client":"VIM12HCNZL"
           },
           "feedType":20,
           "property_folder":"C:\\Users\\Beep\\Desktop\\share",
           "property_lastAccessFolder_ldate":1450111821506
        },
        "property_size":7595.0,
        "property_creation_ldate":"2015-12-14T16:50:20.578Z",
        "property_name":"snip2.PNG",
        "nestedResources":[

        ]
     }
  ]

}

I need to get documents that: resources.source.sourceId.id is exactly "X". I've tried with this query, however its results is empty.

curl -XGET 'http://ESNode01:9201/living_team/inputs/_search?pretty' -d '{
  "query":{
     "filtered":{
        "query":{
           "term":{
              "resources.source.sourceId.batch":"3fcb8905-a307-11e5-88de-382c4ab9e433"
           }
        },
        "filter":{
           "match":{
              "channel":"FeINa"
           }
        }
     }
  }
}'

Answer 1

That's the same issue as in your other question, namely that the resources.source.sourceId.batch string field has been created as an analyzed field and thus the value c38eec2d-a282-11e5-baf4-382c4ab9e433 has been tokenized into the five tokens c38eec2d, a282, 11e5, baf4, 382c4ab9e433.

The correct way to handle this is to set a specific not_analyzed mapping for that field.

Another temporary way out of this would be to use a query_string query with an exact match:

curl -XGET 'http://ESNode01:9201/living_team/inputs/_search?pretty' -d '{
  "query":{
     "filtered":{
        "query":{
           "query_string":{
              "query": "resources.source.sourceId.batch:\"3fcb8905-a307-11e5-88de-382c4ab9e433\""
           }
        },
        "filter":{
           "match":{
              "channel":"FeINa"
           }
        }
     }
  }
}'