Querying for slashes in Elasticsearch 0.90

If you upgrade Elasticsearch from 0.20 to 0.90, any queries you previously made
using a front slash will fail with an error similar to:

1
2
3
4
5
6
7
8
9
10
11

"error" : "SearchPhaseExecutionException[Failed to execute phase [query],
  total failure; shardFailures {[tJ5MGSY_RnOHfeAN2O8gnQ][twitter][2]:
  SearchParseException[[twitter][2]: from[-1],size[-1]: Parse Failure [Failed to
  parse source [{\n   \"query\":{\n      \"query_string\":{\n
  \"query\":\"user:kimchy/banon\"\n      }\n   }\n}]]]; nested:
  QueryParsingException[[twitter] Failed to parse query [user:kimchy/banon]];
  nested: ParseException[Cannot parse 'user:kimchy/banon': Lexical error at line
  1, column 18.  Encountered: <EOF> after : \"/banon\"]; nested:
  TokenMgrError[Lexical error at line 1, column 18.  Encountered: <EOF> after :
  \"/banon\"]; }{[tJ5MGSY_RnOHfeAN2O8gnQ][twitter][0]:
  ...

If you’re like me, you’re thinking “but my query doesn’t have an EOF in it, it’s
valid JSON”, and you’d be right. Your query is still valid JSON, but it’s no
longer a valid Elasticsearch query.

When Elasticsearch moved from 0.20 to 0.90, they changed versions of Lucene as
well, going from 3 to 4. Under Lucene 4, a query with a slash in it is
interpreted as a regular expression. Your regular expression starts with the
slash, but if you only have one slash, it never ends, so you get the
Encountered: <EOF> after : error.

You will need to convert your queries to escape out slashes. Thus, a 0.20 query
of:

1
2
3
4
5
6
7

{
   "query":{
      "query_string":{
         "query":"user:kimchy/banon"
      }
   }
}

…becomes this under Elasticsearch 0.90:

1
2
3
4
5
6
7

{
   "query":{
      "query_string":{
         "query":"user:kimchy\\/banon"
      }
   }
}

Note that this only affects queries; filters are seemingly unaffected.

This was raised in this Github issue.

Leave a Reply

Your email address will not be published. Required fields are marked *