Exact match in elastic search query

Not able to do this with query_string but managed to do so by creating a custom normalizer and then using a "match" or "term" query.

The following steps worked for me.

1. create a custom normalizer (available >V5.2)

   "settings": {
    "analysis": {
      "normalizer": {
        "my_normalizer": {
          "type": "custom",
          "filter": ["lowercase"]
        }
      }
    }
   

   }

2. Create a mapping with type "keyword"

   {
     "mappings": {
       "default": {
         "properties": {
           "title": {
             "type": "text",
             "fields": {
               "normalize": {
                 "type": "keyword",
                 "normalizer": "my_normalizer"
               },
               "keyword" : {
                 "type": "keyword"
               }
             }
           }
         }
       }
     }
   

3. use match or term query

   {
     "query": {
           "bool": {
             "must": [
              {
                "match": {
                  "title.normalize": "string to match"
                }
              }
           ]
         }
       }
     }
   

As stated here: Finding Exact Values, since the field has been analyzed when indexed - you have no way of exact-matching its tokens (":"). Whenever the tokens should be searchable the mapping should be "not_analyzed" and the data needs to be re-indexed.

If you want to be able to easily match only ":feed:" inside the message field you might want to costumize an analyzer which doesn't tokenize ":" so you will be able to query the field with a simple "match" query instead of wild characters.