I'm trying to perform a term aggregation using elastic search for the data below with following query, the output breaks the names into tokens (see output below). So I tried mapping the os_name as multi_field and now I am not able to query by it. Is it possible to have index without tokens? such as "Fedora Core"?
Query:
GET /temp/example/_search
{
"size": 0,
"aggs": {
"OS": {
"terms": {
"field": "os_name"
}
}
}
}
Data:
...
{
"_index": "temp",
"_type": "example",
"_id": "3",
"_score": 1,
"_source": {
"title": "system3",
"os_name": "Fedora Core",
"os_version": 18
}
},
{
"_index": "temp",
"_type": "example",
"_id": "1",
"_score": 1,
"_source": {
"title": "system1",
"os_name": "Fedora Core",
"os_version": 20
}
},
{
"_index": "temp",
"_type": "example",
"_id": "2",
"_score": 1,
"_source": {
"title": "backup",
"os_name": "Yellow Dog",
"os_version": 6
}
}
...
Output:
...
{
"key": "core",
"doc_count": 2
},
{
"key": "fedora",
"doc_count": 2
},
{
"key": "dog",
"doc_count": 1
},
{
"key": "yellow",
"doc_count": 1
}
...
mapping:
PUT /temp
{
"mappings": {
"example": {
"properties": {
"os_name": {
"type": "string"
},
"os_version": {
"type": "long"
},
"title": {
"type": "string"
}
}
}
}
}
Actually you should change your mapping like this
"os_name": {
"type": "string",
"fields": {
"raw": {
"type": "string",
"index": "not_analyzed"
}
}
},
and your aggs should be changed to:
GET /temp/example/_search
{
"size": 0,
"aggs": {
"OS": {
"terms": {
"field": "os_name.raw"
}
}
}
}