# How to find a missing word in elastic search query

**URL:** <https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351>\
**Category:** Elasticsearch\
**Tags:** async-search\
**Created:** [February 13, 2023, 5:45am UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351 "2023-02-13T05:45:37Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jude\_Jerome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jude_jerome/32/46122_2.png) [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\
**Post date:** [February 13, 2023, 5:45am UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/1 "2023-02-13T05:45:37Z")

</div>

Hello Team,

I have a 100 + applications which sending logs daily. I want to filter out the application which does not have a specific word. For example if a application log does not have success keyword then i need to filter that.

I can able to search with success as keyword and get results.

I heard there was a option about missing query which is not available now.

Any inputs ?

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [February 13, 2023, 9:45am UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/2 "2023-02-13T09:45:32Z")

</div>

Hi @Jude_Jerome,

To confirm, are you looking for logs where a particular word doesn't exist in a given field. Would using [`must_not`](https://www.elastic.co/guide/en/elasticsearch/reference/8.6/query-dsl-bool-query.html) help you?

---

<div class="post-metadata">

**Author:** ![Jude\_Jerome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jude_jerome/32/46122_2.png) [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\
**Post date:** [February 15, 2023, 5:38am UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/3 "2023-02-15T05:38:39Z")

</div>

Hello Carly,

I am using must query to filter out the applications, from that applications i need to find out the what are application logs does not have specific word. For example 50 applications log files are processed with message stated "Done" . I need to filter out what are the applications have "Done"and what are those does not have "Done". word in the applications.

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [February 15, 2023, 12:53pm UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/4 "2023-02-15T12:53:26Z")

</div>

Hi @Jude_Jerome ,

Thanks for confirming. Can you share the query you are using currently?

---

<div class="post-metadata">

**Author:** ![Jude\_Jerome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jude_jerome/32/46122_2.png) [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\
**Post date:** [February 16, 2023, 4:54am UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/5 "2023-02-16T04:54:08Z")

</div>

Hello Carly,

Please find the query,

```auto
GET application_stream/_search?size=0
{
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "applicationname.keyword": [
              "Dexapplica",
              "Foxaplica",
              "applicationfive",
              "app",
              "Dfhjju",
              "testapplica",
              "Devapplica",
              "prodapplica",
              "prepord",
              "Clarifica",
              "Dayapplica",
              "Logapplica",
              "testcase",
              "Procesapplica"
            ]
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-30m",
              "lte": "now"
            }
          }
        },
       {
          "match_phrase_prefix": {
            "message": "Log query made progress*"
          }
        }
      ]
    }
  },
  "aggs": {
    "application": {
      "terms": {
        "field": "applicationname.keyword"
      },
      "aggs": {
        "documents": {
          "value_count": {
            "field": "applicationname.keyword"
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [February 16, 2023, 10:12am UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/6 "2023-02-16T10:12:23Z")

</div>

Thanks for that. Are you able to run two queries to get those that are not done separate from those that are done?

---

<div class="post-metadata">

**Author:** ![Jude\_Jerome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jude_jerome/32/46122_2.png) [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\
**Post date:** [February 16, 2023, 5:42pm UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/7 "2023-02-16T17:42:14Z")

</div>

Hello Carly,

I haven’t tried that one. Will you be able to suggest how to achieve atleast with separate query.

---

<div class="post-metadata">

**Author:** ![Jude\_Jerome](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jude_jerome/32/46122_2.png) [@Jude\_Jerome](https://discuss.elastic.co/u/Jude_Jerome)\
**Post date:** [February 20, 2023, 7:06am UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/8 "2023-02-20T07:06:39Z")

</div>

Hello Carly,

```auto
GET index/_search?size=0
{
  "query": {
    "bool": {
      "must_not": {
        "match": {
          "message": "Sucess*"
        }
      }
    }
  }
}

```

The above query works but I am trying to get the same result in one query instead of separate.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2023, 7:07am UTC](https://discuss.elastic.co/t/how-to-find-a-missing-word-in-elastic-search-query/325351/9 "2023-03-20T07:07:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.