ElasticSearch没有返回正确的结果

Question

Currently I'm working with elasticsearch and trying to "search" the documents in the cluster. This is where I am not getting my expected results. I was hoping to get 4 results returned as they all should match the query keyword "te". GET _search

{
"query": {
   "filtered" : {
        "filter" : {
            "term" : {
                "source_id" : 1
            }
        },
        "query": {
            "bool" : {
                "must" : {
                    "term" : { "_all" : "te" }
                }
            }
        }
    }
}, 
"sort": [
  {
     "date": {
        "order": "desc"
     }
  }
], 
    "from": 0,
    "size": 5
}

When I run this query I only get 2 results (while I was expecting 4). When I remove the "query: {}" part I get 4 results, with the following "subject" fields:

{
"subject": ["Testbericht"]
"subject": ["test"]
"subject": ["Testbericht"]
"subject": ["Test to myself"]
}

The filter in the query is to only return results from a specific source (1 source per query).

My mapping:

{
   "messages": {
      "mappings": {
         "message": {
            "_id": {
               "index": "not_analyzed"
            },
            "properties": {
               "addresses": {
                  "type": "nested",
                  "properties": {
                     "displayname": {
                        "type": "string"
                     },
                     "email": {
                        "type": "string"
                     },
                     "name": {
                        "type": "string"
                     },
                     "type": {
                        "type": "string"
                     }
                  }
               },
               "body": {
                  "type": "string"
               },
               "date": {
                  "type": "date",
                  "format": "dateOptionalTime"
               },
               "files": {
                  "type": "nested",
                  "properties": {
                     "size": {
                        "type": "long"
                     },
                     "title": {
                        "type": "string"
                     },
                     "type": {
                        "type": "string"
                     }
                  }
               },
               "folders": {
                  "type": "nested",
                  "properties": {
                     "id": {
                        "type": "integer"
                     }
                  }
               },
               "size": {
                  "type": "long"
               },
               "source_id": {
                  "type": "integer"
               },
               "subject": {
                  "type": "string"
               }
            }
         }
      }
   }
}

The results which I get when I try to search on _all = "te"

{
"subject": ["test"]
"subject": ["Testbericht"]
}

Inserting documents:

// PHP client from https://github.com/elasticsearch/elasticsearch-php
// $this->search = new Elasticsearch\Client();
// $id is an unique string
// $attributes is an array of the attributes
public function insert($id, array $attributes)
{
    $params = [
        'index' => self::INDEX,
        'type' => self::TYPE,
        'id' => $id,
        'body' => [
            'source_id' => $attributes['source_id'],
            'date' => $attributes['date']->format(DateTime::ISO8601),
            'size' => $attributes['size'],
            'subject' => $attributes['subject'],
            'body' => $attributes['body'],
            'addresses' => $attributes['addresses'],
            'files' => $attributes['files'],
            'folders' => $attributes['folders'],
        ],
    ];

    try
    {
        $this->search->index($params);

        return true;
    }
    catch(Exception $e)
    {
        throw new Exception($e->getMessage());
    }

    return false;
}

Answer 1

It seems you are using the standard analyser in all you string fields. This analyser does the lowercase, but it does tokenising on spaces and some special characters. You are searching for "te", which is only a partly match. It should also not be a term for test and TestBericht. I think the mapping you are providing is not correct, or you have other fields that contain the term "te" like in a description of "te sterk" or I am overlooking something. Can you also provide the commands you used for adding the documents as well as the complete response.