# Must not filter not working on fields

**URL:** <https://discuss.elastic.co/t/must-not-filter-not-working-on-fields/31772>\
**Category:** Elasticsearch\
**Created:** [October 7, 2015, 12:48pm UTC](https://discuss.elastic.co/t/must-not-filter-not-working-on-fields/31772 "2015-10-07T12:48:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ankit\_Pradhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankit_pradhan/32/44412_2.png) [@Ankit\_Pradhan](https://discuss.elastic.co/u/Ankit_Pradhan)\
**Post date:** [October 7, 2015, 12:48pm UTC](https://discuss.elastic.co/t/must-not-filter-not-working-on-fields/31772/1 "2015-10-07T12:48:20Z")

</div>

I have three documents:

Doc 1: {  
"DEPLOYMENT\_NAME": "PaymentEngine\_Release\_01",  
"buildingBlockName": "GIOM-TAN-BW"  
}  
Doc 2: {  
"DEPLOYMENT\_NAME": "ProxyXFBAdapter\_01",  
"buildingBlockName": "GIOM-TAN-BW"  
}  
Doc 3: {  
"OTHER\_TERM": "VALUE1",  
"buildingBlockName": "GIOM-TAN",  
}

The mapping of these fields is simple string (default) [which means there is no specific setting saying NOT\_ANALYZED]

I would like to get only those documents where buildingBlockName = "GIOM-TAN-BW" and DEPLOYMENT\_NAME NOT equal to PaymentEngine\_Release\_01, which means only DOC 1

I have tried quite a few combinations of MUST\_NOT, EXIST, BOOL but some how not able to skip DOC 2 and ONLY GET DOC1.

Following query restricts DOC 3 but returns both DOC 1 and DOC 2, while I wanted only DOC 1 to return  
GET /giom/\_search  
{  
"query": {  
"filtered": {  
"query": {  
"bool": {  
"must\_not": [  
{  
"term": {  
"DEPLOYMENT\_NAME": {  
"value": "CustomerFile\_Initiate\_01"  
}  
}  
}  
]  
}  
},  
"filter": {  
"exists": {  
"field": "DEPLOYMENT\_NAME"  
}  
}  
}  
}  
}

Please help ... i am suspecting it has to do with String Analyzer which is not allowing MUST\_NOT to work ... but ##$@#

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [October 7, 2015, 1:06pm UTC](https://discuss.elastic.co/t/must-not-filter-not-working-on-fields/31772/2 "2015-10-07T13:06:18Z")

</div>

Definitely don't analyze the text if you want exact search with text which is non alphanumeric.

---

<div class="post-metadata">

**Author:** ![Ankit\_Pradhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankit_pradhan/32/44412_2.png) [@Ankit\_Pradhan](https://discuss.elastic.co/u/Ankit_Pradhan)\
**Post date:** [October 7, 2015, 1:10pm UTC](https://discuss.elastic.co/t/must-not-filter-not-working-on-fields/31772/3 "2015-10-07T13:10:37Z")

</div>

actually i have no control over the fields appearing so can not place not\_analyzed before hand ...  
and after the field is present with the data ES does not allow to put the not\_analyzed setting because of valid reasons.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [October 7, 2015, 2:30pm UTC](https://discuss.elastic.co/t/must-not-filter-not-working-on-fields/31772/4 "2015-10-07T14:30:05Z")

</div>

Use a template so each of your string fields will also be indexed not analyzed.

A good example is provide by logstash: [https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:46pm UTC](https://discuss.elastic.co/t/must-not-filter-not-working-on-fields/31772/5 "2017-07-05T23:46:08Z")

</div>