Nested must_not query does not return expected results

Elastic Stack Elasticsearch
1

what is the expected behavior for a nested must_not query?
sample query:

{
    "query": {
        "bool": {
            "filter": [
                {
                    "nested": {
                        "path": "participants",
                        "inner_hits": {
                            "name": "participants.1",
                            "_source": [
                                "participants.domain"
                            ],
                            "size": 10
                        },
                        "query": {
                            "bool": {
                                "must_not": [
                                    {
                                        "term": {
                                            "participants.domain.keyword": {
                                                "value": "TO",
                                                "case_insensitive": true
                                            }
                                        }
                                    }
                                ]
                            }
                        }
                    }
                }
            ]
        }
    }
}

this query will return results with some "participants"."domain" = "TO", the inner_hit indicates the result meet the search criteria because one of the "participants"."domain" is "FROM".

 "_source": {
                    "participants": [
                        {
                            "domain": "TO",
                        },
                        {
                            "domain": "FROM",
                        }
                    ]
                }...

But I would expect none of the "participants"."domain" to be "TO", so any document with "participants"."domain"="TO" should not be returned.

2

A nested query matches if any of the nested objects in a doc match the criteria.
On that basis this is expected behaviour.
You could use “copy_to” in your mappings to copy information from child documents to a multi valued field in the root and then use a must_not clause on that.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.