Attached documents and logical query using Elasticsearch

Question

I'm trying to use the must_not boolean query for nested documents, but I get weird results all the time.

Here is an example illustrating my problem.

curl -X DELETE "http://localhost:9200/must_again/"
curl -X POST "http://localhost:9200/must_again/" -d '{
  "mappings": {
    "class": {
      "properties": {
        "title": {
          "type": "string"
        },
        "teachers": {
          "type": "nested",
          "properties": {
            "name": {
              "type": "string"
            }
          }
        }
      }
    }
  }
}'

curl -XPUT 'http://localhost:9200/must_again/class/1' -d '{
  "title": "class1",
  "teachers": [
    {
      "name": "alex"
    },
    {
      "name": "steve"
    }
  ]
}'

curl -XPUT 'http://localhost:9200/must_again/class/2' -d '{
  "title": "class2",
  "teachers": [
    {
      "name": "alex"
    }
  ]
}'

curl -XPUT 'http://localhost:9200/must_again/class/3' -d '{
  "title": "class3",
  "teachers": []
}'

At this moment I have 3 classes, where only where Steve teaches, and one where there is no teacher.

My goal is to get the last 2, every class where Steve doesn't teach.

The request I was working with is

curl -XGET 'http://localhost:9200/must_again/class/_search' -d '{
  "query": {
    "nested": {
      "path": "teachers",
      "query": {
        "bool": {
          "must_not": [
            {
              "match": {
                "teachers.name": "steve"
              }
            }
          ]
        }
      }
    }
  }
}'

It returns

{
  "took": 2,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1.0,
    "hits": [
      {
        "_index": "must_again",
        "_type": "class",
        "_id": "2",
        "_score": 1.0,
        "_source": {
          "title": "class2",
          "teachers": [
            {
              "name": "alex"
            }
          ]
        }
      },
      {
        "_index": "must_again",
        "_type": "class",
        "_id": "1",
        "_score": 1.0,
        "_source": {
          "title": "class1",
          "teachers": [
            {
              "name": "alex"
            },
            {
              "name": "steve"
            }
          ]
        }
      }
    ]
  }
}

So, it is expected class2, but did not class1, and class3no.

If I make the same request with must, I get the correct result (only class1).

Not sure what I am doing wrong?

Answer 1

Walkthrough

curl -XPOST "http://localhost:9200/must_again/class/_search" -d'
{
   "query": {
      "bool": {
         "must_not": [
            {
               "nested": {
                  "path": "teachers",
                  "query": {
                     "bool": {
                        "must": [
                           {
                              "match": {
                                 "teachers.name": "steve"
                              }
                           }
                        ]
                     }
                  }
               }
            }
         ]
      }
   }
}'

, !