Match query with must_not bool filter

Elastic Stack Elasticsearch
1

I am trying to find documents that do not contain certain values in a
field. This is the query I am constructing:

{
"from" : 0,
"size" : 20,
"fliter" : {
"bool" : {
"must" : {
"nested" : {
"filter" : {
"bool" : {
"must_not" : [ {
"query" : {
"match" : {
"country.country_code" : {
"query" :"rus"
}
}
}
}, {
"query" : {
"match" : {
"country.country_code" : {
"query" : "chn"
}
}
}
} ]
}
},
"path": "targets.country"
}
}
}
}
}

I was hoping that the above query will yield documents that don't contain
country code "chn" AND "rus". But what got filtered out were documents that
contain both "chn" and "rus". Documents that contain either "chn" or "rus"
should return.

How should I rewrite the query to filter out documents that contains any of
the two country code?

Thanks.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

You want documents that contain wither "chn" or "rus". Therefore, you need
a logical OR.

Simple fix to your query is to change "must_not" to "should". I think the
minimum_should_match default will be 1, so I don't believe you need to
specify it.

Hope this helps.

Brian

On Friday, July 26, 2013 10:41:47 AM UTC-4, mli wrote:

I am trying to find documents that do not contain certain values in a
field. This is the query I am constructing:

{
"from" : 0,
"size" : 20,
"fliter" : {
"bool" : {
"must" : {
"nested" : {
"filter" : {
"bool" : {
"must_not" : [ {
"query" : {
"match" : {
"country.country_code" : {
"query" :"rus"
}
}
}
}, {
"query" : {
"match" : {
"country.country_code" : {
"query" : "chn"
}
}
}
} ]
}
},
"path": "targets.country"
}
}
}
}
}

I was hoping that the above query will yield documents that don't contain
country code "chn" AND "rus". But what got filtered out were documents that
contain both "chn" and "rus". Documents that contain either "chn" or "rus"
should return.

How should I rewrite the query to filter out documents that contains any
of the two country code?

Thanks.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Ah, not so simple.

Re: I was hoping that the above query will yield documents that don't

contain country code "chn" AND "rus". But what got filtered out were
documents that contain both "chn" and "rus". Documents that contain either
"chn" or "rus" should return.

What you really want is the ES version of the following:

(country.country_code : "chn" OR country.country_code : "rus") AND NOT
(country.country_code : "chn" AND country.country_code : "rus")

Which would return documents with one or the other but not both. Hope this
helps more!

Brian

On Friday, July 26, 2013 3:20:37 PM UTC-4, InquiringMind wrote:

You want documents that contain wither "chn" or "rus". Therefore, you need
a logical OR.

Simple fix to your query is to change "must_not" to "should". I think the
minimum_should_match default will be 1, so I don't believe you need to
specify it.

Hope this helps.

Brian

On Friday, July 26, 2013 10:41:47 AM UTC-4, mli wrote:

I am trying to find documents that do not contain certain values in a
field. This is the query I am constructing:

{
"from" : 0,
"size" : 20,
"fliter" : {
"bool" : {
"must" : {
"nested" : {
"filter" : {
"bool" : {
"must_not" : [ {
"query" : {
"match" : {
"country.country_code" : {
"query" :"rus"
}
}
}
}, {
"query" : {
"match" : {
"country.country_code" : {
"query" : "chn"
}
}
}
} ]
}
},
"path": "targets.country"
}
}
}
}
}

I was hoping that the above query will yield documents that don't contain
country code "chn" AND "rus". But what got filtered out were documents that
contain both "chn" and "rus". Documents that contain either "chn" or "rus"
should return.

How should I rewrite the query to filter out documents that contains any
of the two country code?

Thanks.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.