elastic not returning data if part of string is being used to search

Question

I am having issue while getting data back from elastic Here is mapping

"device": {
   "properties": {
      "deviceName": {
         "type": "string",
         "analyzer": "snowball"
       }
    }
}

When I am using the full device name(i.e ZACe0933d850f) in the query I am getting the result back.

Working Query

{"query": {"bool":{"must":[{"query_string":{"query":"ZACe0933d850f","fields":["*name","*Name","*text","*Text"]}}]}}}

but when I am trying to search using ZAC only I am not getting any results.

Not Working Query

{"query": {"bool":{"must":[{"query_string":{"query":"ZAC","fields":["*name","*Name","*text","*Text"]}}]}}}

Is it something related to snowball Analyzer? I am pretty new to elastic and need some quick help here.

Thanks a lot in advance...

Answer 1

Your problem is that you don't know how exactly elastic searches in text. you'r text will be tokenized and there is a ZACe0933d850f token in your input but not a ZAC. Probably you should use an ngram token filter in your analyzer.