Must_not boolean query in 7.7

[marspy]

After upgrading elasticsearch to 7.7 there is problem with parsing must_not query:
{"error":{"root_cause":[{"type":"parsing_exception","reason":"Failed to parse","line":1,"col":104}],"type":"parsing_exception","reason":"Failed to parse","line":1,"col":104,"caused_by":{"type":"x_content_parse_exception","reason":"[1:104] [bool] failed to parse field [must_not]","caused_by":{"type":"illegal_state_exception","reason":"expected value but got [START_ARRAY]"}}},"status":400}

Syntax accepted prior to version 7.7:

{
    "from": 0,
    "size": 20,
    "track_total_hits": true,
    "query": {
        "bool": {
            "must_not": [
                [
                    {
                        "term": {
                            "fo_system": "3"
                        }
                    }
                ]
            ],
        }
    }
}

And now the must_not part must be changed to:

"must_not": [
                {
                    "term": {
                        "fo_system": "3"
                    }
                }
            ]

Is it correct behaviour or just a bug?

[cbuescher (Christoph)]

@marspy

"must_not": [ [ { "term": { "fo_system": "3" } } ] ]

Hi @marspy, thanks for opening this question and your interest in Elasticseach. We recently made a small change to the parsing logic for this particular query. I think the fact that we previously accepted arrays inside arrays like must_not : [ [ .... ] ] is an error and was only accepted by an unintended leniency in the parsing process. The way this is documented and also should be considered correct is "must_not": [ { ... some query ... }, { ... some other query ... } ].
Hope this helps.

[chikamichi]

Hi @cbuescher. I'm involved with fixing a bug in a library related to the change you mentionned.

Would you be able to pinpoint the specific Elasticsearch version which introduced this change? I need to fix the library using a version flag, so as to keep the source code retrocompatible.

Thank you.

[cbuescher (Christoph)]

The parsing should be tighter with 7.7. Note that the officialy documented syntax with just one array and each query clause as a json object inside should work for all past versions.

[chikamichi]

Thank you. I had pinpointed v7.7 as well. The fact that the change has retrocompatibility baked in will help for sure!

Out of curiosity, would you know which commit / pull request introduced this change?

[cbuescher (Christoph)]

I didn't test it for sure but it most likely was elastic/elasticsearch#52880

[chikamichi]

Thank you!