I have two different behaviours with two queries that are exactly the same

Elastic Stack Elasticsearch
1

I have two different behaviours with two queries that are exactly the same.

In my first query the must_not clause is not filtering brand3 and brand4 is returning brand3 and brand4 products. However the second query the must_not is working. (ES version 1.5.2)

First query:

GET firstindex/product/_search
{  
            "filter":{
                "bool": {
                    "should": [   
                      {"bool": {
                            "must_not":{ "terms": {"brand.raw": ["brand3,brand4"]}
                            },
                            "must":{
                                "term" : {"retailer" : "retailer1"}    
                            }
                         }
                      }
                    ]
                }    
            }
        
    ,
    "size":10000
}

Second query:

GET secondindex/product/_search
{  
            "filter":{
                "bool": {
                    "should": [   
                       {"bool": {
                            "must_not": { "terms": {"brand.raw": ["brand1,brand2"]}
                            },
                            "must":{
                                "term" : {"retailer" : "retailer2"}    
                            }
                         }
                      }
                    ]
                }    
            }
        
    ,
    "size":10000
}

The mapping for brand is:

 "brand":{
                  "type":"string",
                  "fields":{
                     "raw":{
                        "type":"string",
                        "index":"not_analyzed"
                     }
                  }
               }

I got stuck, what I can do to know what is happening? I tried to clear the cache but it's still not working.

Thanks

2

Without knowing how the documents look like you are searching on, this looks like the terms query syntax might be slightly off here. If you are filtering on ["brand3,brand4"] on the raw field, this means you will exclude docs that have exactly that string in that field (both brands, including the comma). I'm guessing you might want ["brand3", "brand4"] instead? Not sure why this makes a difference in your two queries, but the results also depends on your data (after all, the second query is not exactly the same since it has different values in it).

3

That is the problem that "brand3" and "brand4 is not excluding this data but in the second query it's working and is excluding the data.

I have asked a friend that he controls elasticsearch but he doesn't have any idea. He ask me about the cache, I clear the caceh but it's still not working.Very weird? :frowning: