Given the sample data, consider the following two queries:
Query 1
GET bedmaster/_search
{
"query" : {
"term" : { "Parameter" : "HR" }
}
}
Query 2
GET bedmaster/_search
{
"query" : {
"match" : { "Parameter" : "HR" }
}
}
While clearly the documents with Parameter: HR exist, Query 1 does not return anything but Query 2 returns results as expected. Why? This is because “The term query finds documents that contain the exact term specified in the inverted index.”, see the guide.
The content in a document is tokenized into terms and reverted indexed, which means Elasticsearch knows in which document the term being queried appears. When term is used in a query, one needs to provide the tokenized content in order for the match, in this case, lowercased “HR”, see Query 3.
Query 3
GET bedmaster/_search
{
"query" : {
"term" : { "Parameter" : "hr" }
}
}
By default the string field is analyzed, which means the content will go through some types of analyzer to get tokenized for full text search. term query does not care about this process but just tries to match the tokens therefore the content provided in a term query needs to be tokenized as well. On the other hand, match query, in Query 2, will send the query clause to the analyzer first thus it sees the hits even with the uppercased “HR”.
Data Probe 