# Inconsistency with queries on unknown fields

**URL:** <https://discuss.elastic.co/t/inconsistency-with-queries-on-unknown-fields/335841>\
**Category:** Elasticsearch\
**Tags:** eql-elastic-query-language\
**Created:** [June 13, 2023, 8:49am UTC](https://discuss.elastic.co/t/inconsistency-with-queries-on-unknown-fields/335841 "2023-06-13T08:49:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![yfful](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yfful/32/88024_2.png) [@yfful](https://discuss.elastic.co/u/yfful)\
**Post date:** [June 13, 2023, 8:49am UTC](https://discuss.elastic.co/t/inconsistency-with-queries-on-unknown-fields/335841/1 "2023-06-13T08:49:20Z")

</div>

Hello,

If you make a search request with a `geo_bounding_box` query, it will fail with a `QueryShardException` with message `failed to find geo field [my-field]` in the case where the index doesn't have a mapping for `my-field`. However, if you try other queries such as `terms`, it will **not** fail if you execute it over a field that is not defined in the mapping; it will just return no result.

What should I do to make the `geo_bounding_box` query behave like the `terms` query in the case the index is missing a mapping for the field ?

This behaviour happens in Elasticsearch 8.8.

---

<div class="post-metadata">

**Author:** ![Alex\_Salgado-Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_salgado-elastic/32/103081_2.png) [@Alex\_Salgado-Elastic](https://discuss.elastic.co/u/Alex_Salgado-Elastic)\
**Post date:** [June 21, 2023, 8:24pm UTC](https://discuss.elastic.co/t/inconsistency-with-queries-on-unknown-fields/335841/2 "2023-06-21T20:24:22Z")

</div>

> [@yfful](#):
>
> Hello,
> 
> If you make a search request with a `geo_bounding_box` query, it will fail with a `QueryShardException` with message `failed to find geo field [my-field]` in the case where the index doesn't have a mapping for `my-field`. However, if you try other queries such as `terms`, it will **not** fail if you execute it over a field that is not defined in the mapping; it will just return no result.
> 
> What should I do to make the `geo_bounding_box` query behave like the `terms` query in the case the index is missing a mapping for the field ?
> 
> This behaviour happens in Elasticsearch 8.8.

Hi @yfful ,

Can you list the structure of your index?

Thanks

---

<div class="post-metadata">

**Author:** ![yfful](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yfful/32/88024_2.png) [@yfful](https://discuss.elastic.co/u/yfful)\
**Post date:** [June 21, 2023, 9:04pm UTC](https://discuss.elastic.co/t/inconsistency-with-queries-on-unknown-fields/335841/3 "2023-06-21T21:04:22Z")

</div>

Hello @Alex_Salgado-Elastic ,

This can be seen with a bare bone index, default mappings. For example, create an index with just a single document:

```auto
GET test/_search
{
    "_shards": {
        "failed": 0,
        "skipped": 0,
        "successful": 1,
        "total": 1
    },
    "hits": {
        "hits": [
            {
                "_id": "GeG_34gBVnz3g-FH0pXq",
                "_index": "test",
                "_score": 1.0,
                "_source": {
                    "f1": "aaa"
                }
            }
        ],
        "max_score": 1.0,
        "total": {
            "relation": "eq",
            "value": 1
        }
    },
    "timed_out": false,
    "took": 66
}

```

The query with `geo_bounding_box` fails if the field doesn't exist, but `terms` doesn't:

```auto
GET test/_search
{
  "query": {
    "terms": {
      "f2": [
        "aaa"
      ]
    }
  }
}

GET test/_search
{
  "query": {
    "geo_bounding_box": {
      "f2": {
        "top_left": {
          "lat": 41.722535,
          "lon": -0.0109849999999998
        },
        "bottom_right": {
          "lat": 41.195595000000004,
          "lon": 25.169675
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Alex\_Salgado-Elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_salgado-elastic/32/103081_2.png) [@Alex\_Salgado-Elastic](https://discuss.elastic.co/u/Alex_Salgado-Elastic)\
**Post date:** [June 22, 2023, 3:15pm UTC](https://discuss.elastic.co/t/inconsistency-with-queries-on-unknown-fields/335841/4 "2023-06-22T15:15:49Z")

</div>

Have you tried using the "exists" method? This method checks if a specific field exists in a document before executing the query. Here is an example of how you can adapt your query:

```auto
GET test/_search
{
  "query": {
    "bool": {
      "filter": {
        "exists": {
          "field": "f2"
        }
      },
      "must": {
        "geo_bounding_box": {
          "f2": {
            "top_left": {
              "lat": 41.722535,
              "lon": -0.0109849999999998
            },
            "bottom_right": {
              "lat": 41.195595000000004,
              "lon": 25.169675
            }
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![yfful](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yfful/32/88024_2.png) [@yfful](https://discuss.elastic.co/u/yfful)\
**Post date:** [June 22, 2023, 6:56pm UTC](https://discuss.elastic.co/t/inconsistency-with-queries-on-unknown-fields/335841/5 "2023-06-22T18:56:35Z")

</div>

It works but I think it's cumbersome having to put the `exists` query. There may be other queries that have the same issue with missing fields; we'd have to pair every query with an `exists` query then.  
For example, this can become very complex in `bool` queries with a `should` clause. Consider the following with a "natural" expression:

```auto
{
  "query": {
    "bool": {
      "should": [
        {
          "geo_bounding_box": {
            "f2": {
              "top_left": {
                "lat": 41.722535,
                "lon": -0.0109849999999998
              },
              "bottom_right": {
                "lat": 41.195595000000004,
                "lon": 25.169675
              }
            }
          }
        },
        {
          "geo_bounding_box": {
            "f3": {
              "top_left": {
                "lat": 41.722535,
                "lon": -0.0109849999999998
              },
              "bottom_right": {
                "lat": 41.195595000000004,
                "lon": 25.169675
              }
            }
          }
        }
      ]
    }
  }
}

```

With the `exists` query trick, this must be written as:

```auto
{
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "filter": [
              {
                "geo_bounding_box": {
                  "f3": {
                    "top_left": {
                      "lat": 41.722535,
                      "lon": -0.0109849999999998
                    },
                    "bottom_right": {
                      "lat": 41.195595000000004,
                      "lon": 25.169675
                    }
                  }
                }
              },
              {
                "exists": {
                  "field": "f3"
                }
              }
            ]
          }
        },
        {
          "bool": {
            "filter": [
              {
                "geo_bounding_box": {
                  "f2": {
                    "top_left": {
                      "lat": 41.722535,
                      "lon": -0.0109849999999998
                    },
                    "bottom_right": {
                      "lat": 41.195595000000004,
                      "lon": 25.169675
                    }
                  }
                }
              },
              {
                "exists": {
                  "field": "f2"
                }
              }
            ]
          }
        }
      ]
    }
  }
}

```

I think the "natural" expression of the `should` clause is better. The `exists` query fix works for simple cases, but it doesn't seem to scale to more complex ones.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2023, 6:57pm UTC](https://discuss.elastic.co/t/inconsistency-with-queries-on-unknown-fields/335841/6 "2023-07-20T18:57:35Z")

</div>

Closed on July 20, 2023, 6:57pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
