Difference between searching by URL and post body - search

Question

I'm trying to construct a search query based on object's property value, that is inside a nested array.
It works fine:
curl -s -XGET 'http://localhost:9200/products/product/_search?q=items.sku:ABC123'
This doesn't work. Why, what am I missing?:
{
"_source" : "items",
"query": {
"term" : {
"items.sku" : "ABC123"
}
}
}
The item I want to retrieve looks like this:
{
"name" : "Example product"
"brand" : {
"id" : 123,
"name" : "Nike"
},
"items" : [
{
id: 234,
sku: "ABC123"
},
{
id: 456,
sku: "XYZ963"
}
]
}

Answer 1

The query doesn't work because it's not using the same operator than the q operator.
The q operator is a "shortcut" to the use of a query_string query. The equivalent query to what you did would in fact be the following :
{
"_source": "items",
"query": {
"query_string": {
"query": "items.sku:ABC123"
}
}
}
which outputs the document as expected :
"hits": {
"total": 1,
"max_score": 0.19178301,
"hits": [
{
"_index": "products",
"_type": "product",
"_id": "AU_VTrjXeQSEeO15aKQi",
"_score": 0.19178301,
"_source": {
"items": [
{
"id": 234,
"sku": "ABC123"
},
{
"id": 456,
"sku": "XYZ963"
}
]
}
}
]
}
Difference is that the term query search for values that are not analyzed (which in your example, would be ABC123) whereas query_string choose to analyze or not the value according to the mapping of the field being queried.
I think that in your case, the mapping of your field items.sku is simply string, which means that by default, your field is analyzed with standard analyzer : your value has been indexed as abc123 because it has been lowercased (see standard analyzer documentation).
I advise you to read the analysis section of the ElasticSearch Definitive Guide (see here) to have a better understanding of this.