Need to get the field having only null value using query

Elastic Stack Elasticsearch
1

Hi,
I am new to Elastic Search. Kindly help me on below issue.
By using the below query, still I am getting the field having value, which should not happen. Kindly suggest the solution for this issue,

{
"query": {
"filtered": {
"filter": {
"not": {
"filter": {
"missing": {
"field": "resolved"
}
}
}
}
}
}
}

2

Please format your code as explained at About the Elasticsearch category

Then provide a full script which reproduce your issue as shown in the same link.

3

Below is the updated query with proper syntax, in the below query we should be getting only the documents which has resolved = "" or resolved = null, which is not happening, I am even getting the resolved = 'abc'. Kindly let me know if I am missing anything or is there any other way to fix this
POST: /index/type/_search

{
"query": {
"filtered": {
"filter": {
"not": {
"filter": {
"missing": {
"field": "resolved"
}
}
}
}
}
}
}

4

Did you read the documentation I linked to? About formatting?

Here is a script which shows this in action:

DELETE index
PUT index/type/1
{
  "foo": "bar"
}
PUT index/type/2
{
  "foo": null
}
PUT index/type/3
{
  "foo": ""
}
PUT index/type/4
{
  "other": 1
}
GET index/_search
{
  "query": {
    "bool": {
      "must_not": {
        "exists": {
          "field": "foo"
        }
      }
    }
  }
}

Note that it's for 5.0.

It gives:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "index",
        "_type": "type",
        "_id": "2",
        "_score": 1,
        "_source": {
          "foo": null
        }
      },
      {
        "_index": "index",
        "_type": "type",
        "_id": "4",
        "_score": 1,
        "_source": {
          "other": 1
        }
      }
    ]
  }
}

So when the field is null or is not provided, the missing filter (replaced in 5.0 with must_not exists filter) gives expected results.
Obviously "foo":"" means that you provided something which is empty. Technically it's not a missing field or a missing value.

1 Like