# ES BUG? Filter excluding "-" still brings results with dash "-"

**URL:** <https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096>\
**Category:** Elasticsearch\
**Created:** [March 20, 2019, 8:24am UTC](https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096 "2019-03-20T08:24:19Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [March 20, 2019, 8:24am UTC](https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096/1 "2019-03-20T08:24:19Z")

</div>

We have an index with documents which have the value "-" in a field "referrer". However when we try to exclude these values in Kibana, the documents are not filtered out. Digging deeper we see that ElasticSearch does not respect the query:

The query `NOT referrer: \"-\"` returns a document with referrer = `-`.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1aeaa934bf03ad2560ae26b6147c20c7b31558be.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/6/566c4ae3ad88943d274a46ba8ddcdecf24b6972b.png)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 20, 2019, 8:34am UTC](https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096/2 "2019-03-20T08:34:46Z")

</div>

What is the mapping for the referrer field?

---

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [March 20, 2019, 12:23pm UTC](https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096/3 "2019-03-20T12:23:06Z")

</div>

```auto
...
"referrer": {
    "type": "text"
}
...

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 20, 2019, 1:35pm UTC](https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096/4 "2019-03-20T13:35:14Z")

</div>

Such a field is applying a standard analyzer to the text.  
Use the `_analyze` API to see how your text is transformed. Most likely, nothing is indexed.

---

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [March 21, 2019, 11:35am UTC](https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096/6 "2019-03-21T11:35:28Z")

</div>

I'm confused - the field is text (and not analyzed?) so I can't filter on it's existence?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 21, 2019, 12:38pm UTC](https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096/7 "2019-03-21T12:38:42Z")

</div>

`NOT referrer: \"-\"` is not querying on existence of the field but comparing its content. Here you indexed no content. And you are searching for nothing.

Here is an example that shows this:

```auto
DELETE test 
PUT test/_doc/1
{
  "foo": "bar"
}
PUT test/_doc/2
{
  "foo": "-"
}
GET test/_search
{
  "query": {
    "query_string": {
      "query": "NOT foo:\"-\""
    }
  }
}

```

This gives nothing.

But:

```auto
GET test/_search
{
  "query": {
    "query_string": {
      "query": "NOT foo.keyword:\"-\""
    }
  }
}

```

Gives:

```auto
{
  "took" : 20,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "foo" : "bar"
        }
      }
    ]
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2019, 12:38pm UTC](https://discuss.elastic.co/t/es-bug-filter-excluding-still-brings-results-with-dash/173096/8 "2019-04-18T12:38:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.