Elastic search query using python list

Question

How do I pass a list as query string to match_phrase query?

This works:

{"match_phrase": {"requestParameters.bucketName": {"query": "xxx"}}},

This does not:

        {
            "match_phrase": {
                "requestParameters.bucketName": {
                    "query": [
                        "auditloggingnew2232",
                        "config-bucket-123",
                        "web-servers",
                        "esbck-essnap-1djjegwy9fvyl",
                        "tempexpo",
                    ]
                }
            }
        }

Answer 1

match_phrase simply does not support multiple values.

You can either use a should query:

GET _search
{
  "query": {
    "bool": {
      "should": [
        {
          "match_phrase": {
            "requestParameters.bucketName": {
              "value": "auditloggingnew2232"
            }
          }
        },
        {
          "match_phrase": {
            "requestParameters.bucketName": {
              "value": "config-bucket-123"
            }
          }
        }
      ]
    },
    ...
  }
}

or, as @Val pointed out, a terms query:

{
  "query": {
    "terms": {
      "requestParameters.bucketName": [
        "auditloggingnew2232",
        "config-bucket-123",
        "web-servers",
        "esbck-essnap-1djjegwy9fvyl",
        "tempexpo"
      ]
    }
  }
}

that functions like an OR on exact terms.

I'm assuming that 1) the bucket names in question are unique and 2) that you're not looking for partial matches. If that's the case, plus if there are barely any analyzers set on the field bucketName, match_phrase may not even be needed! terms will do just fine. The difference between term and match_phrase queries is nicely explained here.