Must_not usage

Elastic Stack Elasticsearch
1

I have this query:

{
"query": {
"bool" : {
"filter" : {
"term" : { "status" : "404" }
},
"must_not":{
"term": {"url": "/server-status?auto="}
}
}
}
}

I want to retrieve all documents with status = 404, but not having url = "/server-status?auto="

However, docs with that url are still included in the results.

2

Is the field 'status' and 'url' keyword datatype? If not set keyword type explicitly, you should add '.keyword' suffix for field, 'status.keyword' and 'url.keyword'