elasticsearch | Malice 's Customized Elasticsearch | Continuous Deployment library

I am trying to search for a particular string in two fields. Right I am able to get the desired result. Now I want to rank the result in such a way that if value found in one key, it should be given more priority. I tried doing the following way but got error.

In ElasticSearch, what's the rough implementation for an AND-style boolean query where the fields are term types? Does ElasticSearch run filter queries separately on each of the field, and then find their intersections?

For example, if I have something like

I am using the ECK operator, to create an Elasticsearch instance.

The instance uses a StorageClass that has Retain (instead of Delete) as its reclaim policy.

Here are my PVCs before deleting the Elasticsearch instance

I try to search categories and products in Elasticsearch using Nested type.

I have data like this:

I have a complicated Elasticsearch query like the following example. This query has two sub queries: a weighted bool query and a decay function. I am trying to understand how Elasticsearch aggregrates the scores from each sub queries. If I run the first sub query alone (the weighted bool query), my top score is 20. If I run the second sub query alone (the decay function), my score is 1. However, if I run both sub queries together, my top score is 15. Can someone explain this?

My second related question is how to weight the scores from the two sub queries?

I want to be able to search elasticsearch for either an exact match, or a partial search.

my input could be either name: Foobar and in my list of results, I should be able to see any names matching Foobar. Although if I enter Fo* I want to get back any names matching Fosuch as Foreman, Foobill etc.

At the moment, if I search my database I just get back all the results to do with name regardless of what the string looks like.

My code:

I wanted to ask a question about Elasticsearch making 5 shards in each index by default. Well for some reason this is not the case for me. I was wondering whether it was an error on my side (even though I didn't make any changes to the custom template) or this is no longer a case (no longer 5 shards defaultly for each index)? I didn't find anything in documentation or in internet about it. I know I can change this by running:

I want to use the elasticsearch Geo-polygon query (https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-geo-polygon-query.html) or Geo-shape query inside an ingest pipeline and I've been thinking how to do it - as there is no such processor as query processor and the example for the geo polygon is with this type of query.

The reason for me trying to use this tool is to enrich documents which's country location is null, by checking their lat and lon fields and determining which country the doc is from.

Is there anyway this could be done in an ingest pipeline? Or any other way to determine a position by lat and lon within geo shapes in a pipeline?

I have a docker-compose setup with containers logging into fluentd. To support different demo environments, I have events being output to multiple destinations (ElasticSearch, Splunk, Syslog, etc.)

I would like to maintain a single configuration file, but disable output plugins that are not needed. If I have 4 potential output destinations, I would have to maintain 10 different configuration files to support all the different possible combinations.

I know that plugins can use environment variables for configuration parameters, which would be ideal. However, I don't see that there is a common 'enabled' or 'disable' parameter in the underlying plugin architecture.

Is there any way to disable a plugin externally? Or will I have to dynamically build my configuration file from an external script?