# Query to return entries not matching a given value **URL:** \ **Category:** Elasticsearch\ **Created:** [October 16, 2013, 4:32pm UTC](https://discuss.elastic.co/t/query-to-return-entries-not-matching-a-given-value/13973 "2013-10-16T16:32:59Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Vincent\_Massol](https://avatars.discourse-cdn.com/v4/letter/v/ac91a4/32.png) [@Vincent\_Massol](https://discuss.elastic.co/u/Vincent_Massol)\ **Post date:** [October 16, 2013, 4:32pm UTC](https://discuss.elastic.co/t/query-to-return-entries-not-matching-a-given-value/13973/1 "2013-10-16T16:32:59Z")
Hi, I'm trying to perform an ES search to display entries that do not match a given value. Specifically I have a String field that is not\_analyzed and that represents a version. I need to find the way to write the Lucene query that says: return all versions that don't have 'SNAPSHOT' in it. Examples of versions I have: - 5.2 - 5.3-SNAPSHOT - 5.2-milestone-2 I need a query that'll return 5.2 and 5.2-milestone-2 but NOT 5.3-SNAPSHOT... It can be tested here: [http://activeinstalls.xwiki.org/](http://activeinstalls.xwiki.org/) So far I've tried: distributionVersion:\* AND -distributionVersion:_SNAPSHOT_ And distributionVersion:\* AND -distributionVersion:/.\*SNAPSHOT/ And distributionVersion:\* AND -distributionVersion:/[0-9].\*SNAPSHOT/ But none worked... I believe this is because Lucene doesn't support "\*" as the first char. Is there a solution that doesn't involve adding a new field that says whether the version is a snapshot or not? Thanks a lot! -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\ **Post date:** [October 16, 2013, 4:38pm UTC](https://discuss.elastic.co/t/query-to-return-entries-not-matching-a-given-value/13973/2 "2013-10-16T16:38:42Z")
If allow\_leading\_wildcard is set you should be able to start with a wildcard. On Wed, Oct 16, 2013 at 12:32 PM, Vincent Massol [vmassol@gmail.com](mailto:vmassol@gmail.com) wrote: > Hi, > > I'm trying to perform an ES search to display entries that do not match a > given value. > > Specifically I have a String field that is not\_analyzed and that > represents a version. I need to find the way to write the Lucene query that > says: return all versions that don't have 'SNAPSHOT' in it. > > Examples of versions I have: > > - 5.2 > - 5.3-SNAPSHOT > - 5.2-milestone-2 > > I need a query that'll return 5.2 and 5.2-milestone-2 but NOT > 5.3-SNAPSHOT... > > It can be tested here: [http://activeinstalls.xwiki.org/](http://activeinstalls.xwiki.org/) > > So far I've tried: > > distributionVersion:\* AND -distributionVersion:_SNAPSHOT_ > > And > > distributionVersion:\* AND -distributionVersion:/.\*SNAPSHOT/ > > And > > distributionVersion:\* AND -distributionVersion:/[0-9].\*SNAPSHOT/ > > But none worked... > > I believe this is because Lucene doesn't support "\*" as the first char. Is > there a solution that doesn't involve adding a new field that says whether > the version is a snapshot or not? > > Thanks a lot! > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![mattweber](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattweber/32/44940_2.png) [@mattweber](https://discuss.elastic.co/u/mattweber)\ **Post date:** [October 16, 2013, 5:16pm UTC](https://discuss.elastic.co/t/query-to-return-entries-not-matching-a-given-value/13973/3 "2013-10-16T17:16:55Z")
I actually think it is the way the query string is being parsed. Might be a bug or might need some escaping. Your regex version should work, this does: curl -XPOST ' [http://extensions.xwiki.org/activeinstalls/installs/\_search?pretty](http://extensions.xwiki.org/activeinstalls/installs/_search?pretty)' -d '{ "query": { "filtered": { "query": { "match\_all": {} }, "filter": { "bool": { "must\_not": [{"regexp": {"distributionVersion": ".\*SNAPSHOT"}}] } } } } }' Thanks, Matt Weber On Wed, Oct 16, 2013 at 9:38 AM, Nikolas Everett [nik9000@gmail.com](mailto:nik9000@gmail.com) wrote: > If allow\_leading\_wildcard is set you should be able to start with a > wildcard. > > On Wed, Oct 16, 2013 at 12:32 PM, Vincent Massol [vmassol@gmail.com](mailto:vmassol@gmail.com)wrote: > > > Hi, > > > > I'm trying to perform an ES search to display entries that do not match a > > given value. > > > > Specifically I have a String field that is not\_analyzed and that > > represents a version. I need to find the way to write the Lucene query that > > says: return all versions that don't have 'SNAPSHOT' in it. > > > > Examples of versions I have: > > > > - 5.2 > > - 5.3-SNAPSHOT > > - 5.2-milestone-2 > > > > I need a query that'll return 5.2 and 5.2-milestone-2 but NOT > > 5.3-SNAPSHOT... > > > > It can be tested here: [http://activeinstalls.xwiki.org/](http://activeinstalls.xwiki.org/) > > > > So far I've tried: > > > > distributionVersion:\* AND -distributionVersion:_SNAPSHOT_ > > > > And > > > > distributionVersion:\* AND -distributionVersion:/.\*SNAPSHOT/ > > > > And > > > > distributionVersion:\* AND -distributionVersion:/[0-9].\*SNAPSHOT/ > > > > But none worked... > > > > I believe this is because Lucene doesn't support "\*" as the first char. > > Is there a solution that doesn't involve adding a new field that says > > whether the version is a snapshot or not? > > > > Thanks a lot! > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![mattweber](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattweber/32/44940_2.png) [@mattweber](https://discuss.elastic.co/u/mattweber)\ **Post date:** [October 16, 2013, 6:26pm UTC](https://discuss.elastic.co/t/query-to-return-entries-not-matching-a-given-value/13973/4 "2013-10-16T18:26:58Z")
Ok, this is due to the lowercase\_expanded\_terms option defaulting to true on the Query String Query that is used in Kibana. What this means is "/.\*SNAPSHOT/" is being turned into "/.\*snapshot/" which doesn't match your terms since they are not analyzed and uppercase. I feel that lowercase\_expanded\_terms should not be used on a regex query and will open a bug report. In the meantime, if you want to use the following query "-distributionVersion:/.\*SNAPSHOT/" you will need to disable lowercase\_expanded\_terms by disabling it in Kibaba source code file querySrv.js line 106: return ejs.QueryStringQuery(q.query || '\*'); change it to this: return ejs.QueryStringQuery(q.query || '\*').lowercaseExpandedTerms(false); Hope this helps, Matt Weber On Wed, Oct 16, 2013 at 10:16 AM, Matt Weber [matt.weber@gmail.com](mailto:matt.weber@gmail.com) wrote: > I actually think it is the way the query string is being parsed. Might be > a bug or might need some escaping. Your regex version should work, this > does: > > curl -XPOST ' > [http://extensions.xwiki.org/activeinstalls/installs/\_search?pretty](http://extensions.xwiki.org/activeinstalls/installs/_search?pretty)' -d '{ > "query": { > "filtered": { > "query": { > "match\_all": {} > }, > "filter": { > "bool": { > "must\_not": [{"regexp": {"distributionVersion": > ".\*SNAPSHOT"}}] > } > } > } > } > }' > > Thanks, > Matt Weber > > On Wed, Oct 16, 2013 at 9:38 AM, Nikolas Everett [nik9000@gmail.com](mailto:nik9000@gmail.com)wrote: > > > If allow\_leading\_wildcard is set you should be able to start with a > > wildcard. > > > > On Wed, Oct 16, 2013 at 12:32 PM, Vincent Massol [vmassol@gmail.com](mailto:vmassol@gmail.com)wrote: > > > > > Hi, > > > > > > I'm trying to perform an ES search to display entries that do not match > > > a given value. > > > > > > Specifically I have a String field that is not\_analyzed and that > > > represents a version. I need to find the way to write the Lucene query that > > > says: return all versions that don't have 'SNAPSHOT' in it. > > > > > > Examples of versions I have: > > > > > > - 5.2 > > > - 5.3-SNAPSHOT > > > - 5.2-milestone-2 > > > > > > I need a query that'll return 5.2 and 5.2-milestone-2 but NOT > > > 5.3-SNAPSHOT... > > > > > > It can be tested here: [http://activeinstalls.xwiki.org/](http://activeinstalls.xwiki.org/) > > > > > > So far I've tried: > > > > > > distributionVersion:\* AND -distributionVersion:_SNAPSHOT_ > > > > > > And > > > > > > distributionVersion:\* AND -distributionVersion:/.\*SNAPSHOT/ > > > > > > And > > > > > > distributionVersion:\* AND -distributionVersion:/[0-9].\*SNAPSHOT/ > > > > > > But none worked... > > > > > > I believe this is because Lucene doesn't support "\*" as the first char. > > > Is there a solution that doesn't involve adding a new field that says > > > whether the version is a snapshot or not? > > > > > > Thanks a lot! > > > > > > -- > > > You received this message because you are subscribed to the Google > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send > > > an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Vincent\_Massol](https://avatars.discourse-cdn.com/v4/letter/v/ac91a4/32.png) [@Vincent\_Massol](https://discuss.elastic.co/u/Vincent_Massol)\ **Post date:** [October 16, 2013, 7:51pm UTC](https://discuss.elastic.co/t/query-to-return-entries-not-matching-a-given-value/13973/5 "2013-10-16T19:51:26Z")
Thanks so much for your fast and great help guys! I was able to fix my Kibana instance and also to fix my Java code to support what I needed 🙂 FTR here's my java code: @Component @Singleton public class DefaultDataManager implements DataManager { @Inject private JestClientManager jestClientManager; ``` @Override public long getInstallCount(String query) throws Exception { Map queryMap = new HashMap(); queryMap.put("query", query); // This allows to write queries such as: ``` -distributionVersion:\*SNAPSHOT queryMap.put("lowercase\_expanded\_terms", false); ``` Map jsonMap = new HashMap(); jsonMap.put("query_string", JSONObject.fromObject(queryMap)); return executeCount(JSONObject.fromObject(jsonMap).toString()); } private long executeCount(String query) throws Exception { Count count = new Count.Builder(query) .addIndex("installs") .addType("install") .build(); JestResult result = this.jestClientManager.getClient().execute(count ``` ); return ((Double) result.getValue("count")).longValue(); } } Great support, Thanks -Vincent Massol On Wednesday, October 16, 2013 8:26:58 PM UTC+2, Matt Weber wrote: > Ok, this is due to the lowercase\_expanded\_terms option defaulting to true > on the Query String Query that is used in Kibana. What this means is > "/.\*SNAPSHOT/" is being turned into "/.\*snapshot/" which doesn't match your > terms since they are not analyzed and uppercase. I feel that > lowercase\_expanded\_terms should not be used on a regex query and will open > a bug report. In the meantime, if you want to use the following query > "-distributionVersion:/.\*SNAPSHOT/" you will need to disable > lowercase\_expanded\_terms by disabling it in Kibaba source code file > querySrv.js line 106: > > return ejs.QueryStringQuery(q.query || '\*'); > > change it to this: > > return ejs.QueryStringQuery(q.query || '\*').lowercaseExpandedTerms(false); > > Hope this helps, > Matt Weber > > On Wed, Oct 16, 2013 at 10:16 AM, Matt Weber \<[matt....@gmail.com](mailto:matt....@gmail.com)\ > > > wrote: > > > I actually think it is the way the query string is being parsed. Might > > be a bug or might need some escaping. Your regex version should work, this > > does: > > > > curl -XPOST ' > > [http://extensions.xwiki.org/activeinstalls/installs/\_search?pretty](http://extensions.xwiki.org/activeinstalls/installs/_search?pretty)' -d '{ > > "query": { > > "filtered": { > > "query": { > > "match\_all": {} > > }, > > "filter": { > > "bool": { > > "must\_not": [{"regexp": {"distributionVersion": > > ".\*SNAPSHOT"}}] > > } > > } > > } > > } > > }' > > > > Thanks, > > Matt Weber > > > > On Wed, Oct 16, 2013 at 9:38 AM, Nikolas Everett \<[nik...@gmail.com](mailto:nik...@gmail.com)\ > > > > > wrote: > > > > > If allow\_leading\_wildcard is set you should be able to start with a > > > wildcard. > > > > > > On Wed, Oct 16, 2013 at 12:32 PM, Vincent Massol \<[vma...@gmail.com](mailto:vma...@gmail.com)\ > > > > > > > wrote: > > > > > > > Hi, > > > > > > > > I'm trying to perform an ES search to display entries that do not match > > > > a given value. > > > > > > > > Specifically I have a String field that is not\_analyzed and that > > > > represents a version. I need to find the way to write the Lucene query that > > > > says: return all versions that don't have 'SNAPSHOT' in it. > > > > > > > > Examples of versions I have: > > > > > > > > - 5.2 > > > > - 5.3-SNAPSHOT > > > > - 5.2-milestone-2 > > > > > > > > I need a query that'll return 5.2 and 5.2-milestone-2 but NOT > > > > 5.3-SNAPSHOT... > > > > > > > > It can be tested here: [http://activeinstalls.xwiki.org/](http://activeinstalls.xwiki.org/) > > > > > > > > So far I've tried: > > > > > > > > distributionVersion:\* AND -distributionVersion:_SNAPSHOT_ > > > > > > > > And > > > > > > > > distributionVersion:\* AND -distributionVersion:/.\*SNAPSHOT/ > > > > > > > > And > > > > > > > > distributionVersion:\* AND -distributionVersion:/[0-9].\*SNAPSHOT/ > > > > > > > > But none worked... > > > > > > > > I believe this is because Lucene doesn't support "\*" as the first char. > > > > Is there a solution that doesn't involve adding a new field that says > > > > whether the version is a snapshot or not? > > > > > > > > Thanks a lot! > > > > > > > > -- > > > > You received this message because you are subscribed to the Google > > > > Groups "elasticsearch" group. > > > > To unsubscribe from this group and stop receiving emails from it, send > > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > > > -- > > > You received this message because you are subscribed to the Google > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:12am UTC](https://discuss.elastic.co/t/query-to-return-entries-not-matching-a-given-value/13973/6 "2017-07-06T02:12:06Z")