I have two different behaviours with two queries that are exactly the same

I have two different behaviours with two queries that are exactly the same.

In my first query the must_not clause is not filtering brand3 and brand4 is returning brand3 and brand4 products. However the second query the must_not is working. (ES version 1.5.2)

First query:

GET firstindex/product/_search
{  
            "filter":{
                "bool": {
                    "should": [   
                      {"bool": {
                            "must_not":{ "terms": {"brand.raw": ["brand3,brand4"]}
                            },
                            "must":{
                                "term" : {"retailer" : "retailer1"}    
                            }
                         }
                      }
                    ]
                }    
            }
        
    ,
    "size":10000
}

Second query:

GET secondindex/product/_search
{  
            "filter":{
                "bool": {
                    "should": [   
                       {"bool": {
                            "must_not": { "terms": {"brand.raw": ["brand1,brand2"]}
                            },
                            "must":{
                                "term" : {"retailer" : "retailer2"}    
                            }
                         }
                      }
                    ]
                }    
            }
        
    ,
    "size":10000
}

The mapping for brand is:

 "brand":{
                  "type":"string",
                  "fields":{
                     "raw":{
                        "type":"string",
                        "index":"not_analyzed"
                     }
                  }
               }

I got stuck, what I can do to know what is happening? I tried to clear the cache but it's still not working.

Thanks

Without knowing how the documents look like you are searching on, this looks like the terms query syntax might be slightly off here. If you are filtering on ["brand3,brand4"] on the raw field, this means you will exclude docs that have exactly that string in that field (both brands, including the comma). I'm guessing you might want ["brand3", "brand4"] instead? Not sure why this makes a difference in your two queries, but the results also depends on your data (after all, the second query is not exactly the same since it has different values in it).

That is the problem that "brand3" and "brand4 is not excluding this data but in the second query it's working and is excluding the data.

I have asked a friend that he controls elasticsearch but he doesn't have any idea. He ask me about the cache, I clear the caceh but it's still not working.Very weird? :frowning: