How can I query a count on documents that may not have a field set?

Elastic Stack Elasticsearch
1

I've defined my mapping with a field such as "state_reason". What I want to do is be able to query and show all records that do not have "state_reason" set.

2

I think you might be looking for the missing query?

3

Thanks @colings86, I think that maybe what I was looking for, although I tested it and getting a strange response (index already exists).

If I do a GET on the index it works fine, and my response is:

{
  "jnap": {
    "aliases": {},
    "mappings": {
      "overall": {
        "properties": {
          "model": {
            "type": "string",
            "index": "not_analyzed"
          },
          "state": {
            "type": "string",
            "index": "not_analyzed"
          },
          "timestamp": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "vin": {
            "type": "string"
          }
        }
      },
      "inspection": {
        "properties": {
          "bypass": {
            "type": "string",
            "index": "not_analyzed"
          },
          "expected": {
            "type": "string",
            "index": "not_analyzed"
          },
          "expected color": {
            "type": "string"
          },
          "found": {
            "type": "string"
          },
          "found color": {
            "type": "string"
          },
          "image": {
            "type": "string",
            "index": "not_analyzed"
          },
          "inspection": {
            "type": "string",
            "index": "not_analyzed"
          },
          "location": {
            "type": "string",
            "index": "not_analyzed"
          },
          "model": {
            "type": "string",
            "index": "not_analyzed"
          },
          "state": {
            "type": "string",
            "index": "not_analyzed"
          },
          "state_reason": {
            "type": "string",
            "index": "not_analyzed"
          },
          "timestamp": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "vehicle_color": {
            "type": "string",
            "index": "not_analyzed"
          },
          "vin": {
            "type": "string"
          }
        }
      }
    },
    "settings": {
      "index": {
        "creation_date": "1469554327968",
        "number_of_shards": "5",
        "number_of_replicas": "1",
        "uuid": "6UVhwuZUT-ioH6vt2ON3uA",
        "version": {
          "created": "2010299"
        }
      }
    },
    "warmers": {}
  }
}

But when I try with the missing clause, I get

GET jnap
{
  "query": {
    "constant_score": {
      "filter": {
        "missing": {
          "field": "state_reason"
        }
      }
    }
  }
}

Response is:

{
   "error": {
      "root_cause": [
         {
            "type": "index_already_exists_exception",
            "reason": "already exists",
            "index": "jnap"
         }
      ],
      "type": "index_already_exists_exception",
      "reason": "already exists",
      "index": "jnap"
   },
   "status": 400
}

I'm using Elasticsearch 2.1.2.

4

Use GET jnap/_search instead of GET jnap.

6

That worked @nik9000. . I've been using the python DSL library and at lot of that has been taken care of for me, so newbie slip up on my part. Thanks for the help!