# Must\_not boolean query in 7.7

**URL:** <https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269>\
**Category:** Elasticsearch\
**Created:** [May 19, 2020, 8:07am UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269 "2020-05-19T08:07:22Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![marspy](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@marspy](https://discuss.elastic.co/u/marspy)\
**Post date:** [May 19, 2020, 8:07am UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269/1 "2020-05-19T08:07:22Z")

</div>

After upgrading elasticsearch to 7.7 there is problem with parsing must\_not query:  
`{"error":{"root_cause":[{"type":"parsing_exception","reason":"Failed to parse","line":1,"col":104}],"type":"parsing_exception","reason":"Failed to parse","line":1,"col":104,"caused_by":{"type":"x_content_parse_exception","reason":"[1:104] [bool] failed to parse field [must_not]","caused_by":{"type":"illegal_state_exception","reason":"expected value but got [START_ARRAY]"}}},"status":400}`

Syntax accepted prior to version 7.7:

```auto
{
    "from": 0,
    "size": 20,
    "track_total_hits": true,
    "query": {
        "bool": {
            "must_not": [
                [
                    {
                        "term": {
                            "fo_system": "3"
                        }
                    }
                ]
            ],
        }
    }
}

```

And now the must\_not part must be changed to:

```auto
"must_not": [
                {
                    "term": {
                        "fo_system": "3"
                    }
                }
            ]

```

Is it correct behaviour or just a bug?

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [May 19, 2020, 6:27pm UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269/2 "2020-05-19T18:27:08Z")

</div>

> [@marspy](#):
>
> "must\_not": [[{ "term": { "fo\_system": "3" } }] ]

Hi @marspy, thanks for opening this question and your interest in Elasticseach. We recently made a small change to the parsing logic for this particular query. I think the fact that we previously accepted arrays inside arrays like `must_not : [[ ....] ]` is an error and was only accepted by an unintended leniency in the parsing process. The way this is documented and also should be considered correct is `"must_not": [{ ... some query ... }, { ... some other query ... }]`.  
Hope this helps.

---

<div class="post-metadata">

**Author:** ![chikamichi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chikamichi/32/11638_2.png) [@chikamichi](https://discuss.elastic.co/u/chikamichi)\
**Post date:** [May 20, 2020, 11:07pm UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269/3 "2020-05-20T23:07:27Z")

</div>

Hi @cbuescher. I'm involved with fixing a bug in a library related to the change you mentionned.

Would you be able to pinpoint the specific Elasticsearch version which introduced this change? I need to fix the library using a version flag, so as to keep the source code retrocompatible.

Thank you.

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [May 25, 2020, 8:28am UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269/4 "2020-05-25T08:28:29Z")

</div>

The parsing should be tighter with 7.7. Note that the officialy documented syntax with just one array and each query clause as a json object inside should work for all past versions.

---

<div class="post-metadata">

**Author:** ![chikamichi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chikamichi/32/11638_2.png) [@chikamichi](https://discuss.elastic.co/u/chikamichi)\
**Post date:** [May 25, 2020, 10:48am UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269/5 "2020-05-25T10:48:34Z")

</div>

Thank you. I had pinpointed v7.7 as well. The fact that the change has retrocompatibility baked in will help for sure!

Out of curiosity, would you know which commit / pull request introduced this change?

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [May 27, 2020, 3:33pm UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269/6 "2020-05-27T15:33:57Z")

</div>

I didn't test it for sure but it most likely was [elastic/elasticsearch#52880](https://github.com/elastic/elasticsearch/pull/52880)

---

<div class="post-metadata">

**Author:** ![chikamichi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chikamichi/32/11638_2.png) [@chikamichi](https://discuss.elastic.co/u/chikamichi)\
**Post date:** [May 27, 2020, 5:13pm UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269/7 "2020-05-27T17:13:56Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2020, 5:14pm UTC](https://discuss.elastic.co/t/must-not-boolean-query-in-7-7/233269/8 "2020-06-24T17:14:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.