Querying Elasticsearch by combining a range and a term match json format

Question

I am trying to query an Elasticsearch index by a time range, and additionally have a term match a specific string value.

I have tried this query, which seems pretty straightforward:

 {
  "query" : {
    "bool": {
      "must": [
        {
          "match": {
            "method": "/customer/help"
          }
        },
        {
          "range" : {
            "startTime": {
              "from" : "2015-10-20T13:00-04:00",
              "to" : "2015-10-20T14:00-04:00"
            }
          }
        }
      ]
    }
  }
}

In this case, I want all of the documents within the given time range that also have a method value of "/customer/help".

In my results, I am receiving results that are within the time range, but I am getting documents that have various values for the "method" field, when I just want results with "/customer/help" in that field.

Answer 1

In your mapping you need to have method as not_analyzed (or analyzed with keyword analyzer) and the query should use term. In this way, the text you index in method is indexed as is as a single token and term makes sure the text you search matches exactly the token indexed in method:

    "method": {
      "type": "string",
      "index": "not_analyzed"
    }

And the query you need to use:

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "method": "/customer/help"
          }
        },
        {
          "range": {
            "startTime": {
              "from": "2015-10-20T13:00-04:00",
              "to": "2015-10-20T14:00-04:00"
            }
          }
        }
      ]
    }
  }
}