Must not filter not working on fields


(Ankit Pradhan) #1

I have three documents:

Doc 1: {
"DEPLOYMENT_NAME": "PaymentEngine_Release_01",
"buildingBlockName": "GIOM-TAN-BW"
}
Doc 2: {
"DEPLOYMENT_NAME": "ProxyXFBAdapter_01",
"buildingBlockName": "GIOM-TAN-BW"
}
Doc 3: {
"OTHER_TERM": "VALUE1",
"buildingBlockName": "GIOM-TAN",
}

The mapping of these fields is simple string (default) [ which means there is no specific setting saying NOT_ANALYZED ]

I would like to get only those documents where buildingBlockName = "GIOM-TAN-BW" and DEPLOYMENT_NAME NOT equal to PaymentEngine_Release_01, which means only DOC 1

I have tried quite a few combinations of MUST_NOT, EXIST, BOOL but some how not able to skip DOC 2 and ONLY GET DOC1.

Following query restricts DOC 3 but returns both DOC 1 and DOC 2, while I wanted only DOC 1 to return
GET /giom/_search
{
"query": {
"filtered": {
"query": {
"bool": {
"must_not": [
{
"term": {
"DEPLOYMENT_NAME": {
"value": "CustomerFile_Initiate_01"
}
}
}
]
}
},
"filter": {
"exists": {
"field": "DEPLOYMENT_NAME"
}
}
}
}
}

Please help ... i am suspecting it has to do with String Analyzer which is not allowing MUST_NOT to work ... but ##$@#


(David Pilato) #2

Definitely don't analyze the text if you want exact search with text which is non alphanumeric.


(Ankit Pradhan) #3

actually i have no control over the fields appearing so can not place not_analyzed before hand ...
and after the field is present with the data ES does not allow to put the not_analyzed setting because of valid reasons.


(David Pilato) #4

Use a template so each of your string fields will also be indexed not analyzed.

A good example is provide by logstash: https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json


(system) #5