<p>Below is the query part in <code>Elastic</code> GET API via command line inside <code>openshift</code> pod , i get all the match query as well as unmatch element in the fetch of 2000 documents. how can i limit to only the match element.
i want to specifically get <code>{\"kubernetes.container_name\":\"xyz\"}}</code> only.</p>

<p>any suggestions will be appreciated </p>

<pre><code>-d ' {\"query\": { \"bool\" :{\"must\" :{\"match\" :{\"kubernetes.container_name\":\"xyz\"}},\"filter\" : {\"range\": {\"@timestamp\": {\"gte\": \"now-2m\",\"lt\": \"now-1m\"}}}}},\"_source\":[\"@timestamp\",\"message\",\"kubernetes.container_name\"],\"size\":2000}'"
</code></pre>

Sarbojeet Das
<p>For exact matches there are two things you would need to do:</p>

<ul>
<li>Make use of <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html" rel="nofollow noreferrer">Term Queries</a></li>
<li>Ensure that the field is of type <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html" rel="nofollow noreferrer"><code>keyword</code></a> datatype.</li>
</ul>

<p><a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html" rel="nofollow noreferrer">Text</a> datatype goes through <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis.html" rel="nofollow noreferrer">Analysis</a> phase.</p>

<p>For e.g. if you data is <code>This is a beautiful day</code>, during ingestion, <code>text</code> datatype would break down the words into tokens, lowercase them <code>[this, is, a, beautiful, day]</code> and then add them to the inverted index. This process happens via <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-standard-analyzer.html" rel="nofollow noreferrer">Standard Analyzer</a> which is the default analyzer applied on text field. </p>

<p>So now when you query, it would again apply the analyzer at <em>querying time</em> and would search if the words are present in the respective documents. As a result you see documents <em>even without</em> exact match appearing. </p>

<p>In order to do an exact match, you would need to make use of <code>keyword</code> fields as it <em>does not</em> goes through the analysis phase. </p>

<p>What I'd suggest is to create a keyword sibling field for text field that you have in below manner and then re-ingest all the data:</p>

<h2>Mapping:</h2>

<pre><code>PUT my_sample_index
{
  "mappings": {
    "properties": {
      "kubernetes":{
        "type": "object",
        "properties": {
          "container_name": {
            "type": "text",
            "fields":{               &lt;--- Note this
              "keyword":{            &lt;--- This is container_name.keyword field
                "type": "keyword"
              }
            }
          }
        }
      }
    }
  }
}
</code></pre>

<p>Note that I'm assuming you are making use of <code>object</code> type.</p>

<h2>Request Query:</h2>

<pre><code>POST my_sample_index
{
  "query":{
    "bool": {
      "must": [
        {
          "term": {
            "kubernetes.container_name.keyword": {
              "value": "xyz"
            }
          }
        }
      ]
    }
  }
}
</code></pre>

<p>Hope this helps!</p>
