Must_not boolean query in 7.7

After upgrading elasticsearch to 7.7 there is problem with parsing must_not query:
{"error":{"root_cause":[{"type":"parsing_exception","reason":"Failed to parse","line":1,"col":104}],"type":"parsing_exception","reason":"Failed to parse","line":1,"col":104,"caused_by":{"type":"x_content_parse_exception","reason":"[1:104] [bool] failed to parse field [must_not]","caused_by":{"type":"illegal_state_exception","reason":"expected value but got [START_ARRAY]"}}},"status":400}

Syntax accepted prior to version 7.7:

{
    "from": 0,
    "size": 20,
    "track_total_hits": true,
    "query": {
        "bool": {
            "must_not": [
                [
                    {
                        "term": {
                            "fo_system": "3"
                        }
                    }
                ]
            ],
        }
    }
}

And now the must_not part must be changed to:

"must_not": [
                {
                    "term": {
                        "fo_system": "3"
                    }
                }
            ]

Is it correct behaviour or just a bug?

1 Like

Hi @marspy, thanks for opening this question and your interest in Elasticseach. We recently made a small change to the parsing logic for this particular query. I think the fact that we previously accepted arrays inside arrays like must_not : [ [ .... ] ] is an error and was only accepted by an unintended leniency in the parsing process. The way this is documented and also should be considered correct is "must_not": [ { ... some query ... }, { ... some other query ... } ].
Hope this helps.

2 Likes

Hi @cbuescher. I'm involved with fixing a bug in a library related to the change you mentionned.

Would you be able to pinpoint the specific Elasticsearch version which introduced this change? I need to fix the library using a version flag, so as to keep the source code retrocompatible.

Thank you.

The parsing should be tighter with 7.7. Note that the officialy documented syntax with just one array and each query clause as a json object inside should work for all past versions.

Thank you. I had pinpointed v7.7 as well. The fact that the change has retrocompatibility baked in will help for sure!

Out of curiosity, would you know which commit / pull request introduced this change?

I didn't test it for sure but it most likely was elastic/elasticsearch#52880

1 Like

Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.