Find docs where field value does not exists in other docs

Elastic Stack Elasticsearch
1

Hey.

I have a problem retrieving all the docs, that do not have corresponding other logs by field valuye. I would appreciate any help given. The easiest to explain is with example:

I have the following 3 docs:
DOC1:

{
     message: Step1,
     id: 100
}

DOC2:

{
     message: Step2,
     id: 100
}

DOC3:

{
     message: Step1,
     id: 200
}

So what i would like as a reponse from a query, would be all the docs, where Step1 does not have corresponding Step2, where id value is the same. In example below, this is:
DOC3:

{
     message: Step1,
     id: 200
}

What i tried so far is not the result i would like. This returns count of docs by id and ascending order, but since we have many other Steps, this is not ok, and results with value 1 will not be always correct.

  GET index/_search
  {
      "size": 0, 
      "aggs" : {
          "langs" : {
              "terms" : { 
                    "field" : "id",  
                    "size" : 10, 
                    "order": {
                      "_count": "asc"
                     }
               }
          }
     } 
}

MORE DETAILS In response, I need docs, that does not have 2 docs related with one id field (each result should have only 1 doc with related id and message=Step1).

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.