Query returns both documents instead of just one

Question

var res = esclient.Search<MyClass>(q => q
                .Query(fq => fq
                    .Filtered(fqq => fqq
                        .Query(qq => qq.MatchAll())
                        .Filter(ff => ff
                            .Bool(b => b
                                .Must(m1 => m1.Term("macaddress", "mac"))
                                .Must(m2 => m2.Term("another_field", 123))
                            )
                        )
                    )
                )
            );

As far as I can understand the bool and must together are the equivalent of the AND operator. I've got an index with two documents in it, only one matches the two constraints (macaddress and another_field) but Elasticsearch returns both.

this is the mapping:

{
   "reviewer-test-index": {
      "aliases": {},
      "mappings": {
         "historyRecord": {
            "properties": {
               "groupName": {
                  "type": "string"
               },
               "groupNo": {
                  "type": "integer"
               },
               "instrType": {
                  "type": "integer"
               },
               "instrumentAddress": {
                  "type": "string"
               },
               "insturmentName": {
                  "type": "string"
               },
               "macAddr": {
                  "type": "string"
               },
               "uhhVersion": {
                  "type": "string"
               }
            }
         },         
      "settings": {
         "index": {
            "creation_date": "1434557536720",
            "number_of_shards": "1",
            "number_of_replicas": "0",
            "version": {
               "created": "1050299"
            },
            "uuid": "FfQADLGVQVOPV3913exKsw"
         }
      },
      "warmers": {}
   }
}

I also tried to make a JSON query but I get 0 hits:

GET _search
{
  "query" :{
  "filtered": {
    "query": {
      "match_all": { }
    },
   "filter": {
      "bool" : {
            "must" : [
                {"term" : { "macAddr" : "000A8D810F5A" } },
                {"term" : { "insturmentName" : "Amin's furnace" } },
                {"term" : { "instrumentAddress" : "8D810F5A"}},
                {"term" : { "uhhVersion" :  "v2.5"}},
                {"term" : { "groupName" :  "Amin's Group"}},
                {"term" : { "groupNo" :  2}},
                {"term" : { "instrType" :  60}}
            ]
         }
    }
  }
  }
}

Response:

{
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 4,
      "successful": 3,
      "failed": 0
   },
   "hits": {
      "total": 0,
      "max_score": null,
      "hits": []
   }
}

Answer 1

term filters don't analyze the text to be searched. Meaning, if you search for 000A8D810F5A, this is exactly what is searching for (upper-case letters included).

But, your macAddr and insturmentName fields and others are just strings. Meaning, they use the standard analyzer which lowercases the terms. So, you are searching for 000A8D810F5A but in the index you probably have 000a8d810f5a (notice the lowercase letters).

So, you need to either have those fields not_analyzed or analyzed with the keyword analyzer or, if you want to keep them analyzed by default with standard analyzer, add a .raw multifield that should be not_analyzed or keyword analyzed and use that in your search. For example, "term" : { "macAddr.raw" : "000A8D810F5A" }.

Suggested mapping:

  "mappings": {
     "historyRecord": {
        "properties": {
           "groupName": {
              "type": "string",
              "fields": {
                 "raw": {
                    "type": "string",
                    "index": "not_analyzed"
                 }
              }
           },
           "groupNo": {
              "type": "integer"
           },
           "instrType": {
              "type": "integer"
           },
           "instrumentAddress": {
              "type": "string",
              "fields": {
                 "raw": {
                    "type": "string",
                    "index": "not_analyzed"
                 }
              }
           },
           "insturmentName": {
              "type": "string",
              "fields": {
                 "raw": {
                    "type": "string",
                    "index": "not_analyzed"
                 }
              }
           },
           "macAddr": {
              "type": "string",
              "fields": {
                 "raw": {
                    "type": "string",
                    "index": "not_analyzed"
                 }
              }
           },
           "uhhVersion": {
              "type": "string",
              "fields": {
                 "raw": {
                    "type": "string",
                    "index": "not_analyzed"
                 }
              }
           }
        }
     }

Suggested query:

{
  "query" :{
  "filtered": {
    "query": {
      "match_all": { }
    },
   "filter": {
      "bool" : {
            "must" : [
                {"term" : { "macAddr.raw" : "000A8D810F5A" } },
                {"term" : { "insturmentName.raw" : "Amin's furnace" } },
                {"term" : { "instrumentAddress.raw" : "8D810F5A"}},
                {"term" : { "uhhVersion.raw" :  "v2.5"}},
                {"term" : { "groupName.raw" :  "Amin's Group"}},
                {"term" : { "groupNo" :  2}},
                {"term" : { "instrType" :  60}}
            ]
         }
    }
  }
  }
}