Elasticsearch - full text search - php

Question

I am trying to match "new york" in a search (not places containing "new" or "york" separately)
here is my current query:
"query" : {
"query_string" : {
"query" : "new york" ,
"fields" : ["city"]
}
},
"filter" : {
"and" : [{
"query" : {
"query_string" : {
"query" : "country:US"
}
}
}]
}
However this keeps returning places named "york" rather than "new york"
I am not fully understanding how this works and would appreciate some help in getting this to actually work for me.

Answer 1

If you want both words to appear in the same document you need to change the default operator like this:
"query" : {
"query_string" : {
"query" : "new york" ,
"fields" : ["city"],
"default_operator" : "AND"
}
}
or specify it ion the query:
"query" : {
"query_string" : {
"query" : "new AND york" ,
"fields" : ["city"]
}
}
Have a look at the query string documentation.
Otherwise, if you want both words to appear close to each other in the same document you need to make a phrase query like this:
"query" : {
"match_phrase" : {
"message" : "new york"
}
}

Answer 2

By default the city field in "analyzed" by Elasticsearch which does the default tokenization of words.
New York => *New*, *York*
In order to keep the tokens intact (mostly used for aggregation), you need to explicitly make the city field "not analyzed" using multi field
'city' => [
'type' => 'string',
'fields' => [
'raw' => [
'type' => 'string',
'index' => 'not_analyzed'
]
]
]
Now you can use city.raw to get non analyzed values.