In setting up my elasticsearch index, I noticed a strange inconsistency in how query strings are handled by ES. For querystrings, there is a field title default_operator as per https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html, which should default to OR, and which should work as they explain below
OR (Default) For example, a query string of capital of Hungary is interpreted as capital OR of OR Hungary.
Now this does work for any text field. For example, if I search on my text field title like "+title:(value1 value2)", then it does get me anything with value1 or value 2 in the title. When using profile, I can see the following explanation
"query": [
{
"type": "BooleanQuery",
"description": "title:value1 title:value2",
"time_in_nanos": 31667524,
...
This is how I would expect this to work.
However, when I do a querystring with a keyword field, the behavior is totally different. Instead, for my keyword field, a query string like "+data_source_id:(value1 value2)" actually returns nothing and the profile shows:
query": [
{
"type": "TermQuery",
"description": "data_source_id:value1 value2",
"time_in_nanos": 193560,
...
I am able to accomplish what I want by doing instead the search "+data_source_id:(value1 OR value2)", but I am a little confused by the inconsistency.
Is there a reason that it works this way? Additionally, is there a way to get querystring to parse my keyword terms with the boolean operator to keep the experience the same for the users (who don't necessarily know the behavior of my backend).
I would presume this is because elasticsearch only does exact matching searches for keyword fields and they don't want to force you to use quotations for a multiword keyword field, however, in my implementation the keyword fields are always a single word so it would be helpful to be able to set this as default behavior.