Is the term, attached documents and must_not query incompatible in ElasticSearch?

Question

I have problems with combining terms, must_not requests for attached documents.

An example of meaning can be found here: http://sense.qbox.io/gist/be436a1ffa01e4630a964f48b2d5b3a1ef5fa176

Here is my mapping:

{ "mappings": { "docs" : { "properties": { "tags" : { "type": "nested", "properties" : { "type": { "type": "string", "index": "not_analyzed" } } }, "label" : { "type": "string" } } } } } 

with two documents in this index:

 { "tags" : [ {"type" : "POST"}, {"type" : "DELETE"} ], "label" : "item 1" }, { "tags" : [ {"type" : "POST"} ], "label" : "item 2" } 

When I query this index as follows:

 { "query": { "nested": { "path": "tags", "query": { "bool": { "must": { "term": { "tags.type": "DELETE" } } } } } } } 

I have one hit (which is correct)

When I want to receive documents that DO NOT CONTAIN the "DELETE" tag with this request:

 { "query": { "nested": { "path": "tags", "query": { "bool": { "must_not": { "term": { "tags.type": "delete" } } } } } } } 

I have 2 hits (which is wrong). This question seems very close to this (the Elasticsearch array should and must_not ), but it is not ...

Can you give me some tips to solve this problem?

thanks

Answer 1

This should fix your problem: http://sense.qbox.io/gist/f4694f542bc76c29624b5b5c9b3ecdee36f7e3ea

The two most important things:

• include_in_root on "tags.type". This will show that the ES will index tag types as "doc.tags.types" : ['DELETE', 'POSTS'] , so you can access the array of these values, “flattened” in the root document. This means that you no longer need a subquery (see # 2)

• Drop the subquery.

 { "mappings": { "docs" : { "properties": { "tags" : { "type": "nested", "properties" : { "type": { "type": "string", "index": "not_analyzed" } }, "include_in_root": true }, "label" : { "type": "string" } } } } } 

 { "query": { "bool": { "must_not": { "term": { "tags.type": "DELETE" } } } } } 

Answer 2

Your original request will search in each separate nested object and eliminate those objects that do not agree, but if there are several nested objects, they agree with your request and therefore you will receive your results. This is because nested objects are indexed as a hidden separate document.

Source:

 { "query": { "nested": { "path": "tags", "query": { "bool": { "must_not": { "term": { "tags.type": "delete" } } } } } } } 

Now the solution is quite simple, you have to push the bool request outside of the attached documents. Now all documents are discarded that have a nested object of type DELETE . Just what you wanted!

Decision:

 { "query": { "bool": { "must_not": { "nested": { "path": "tags", "query": { "term": { "tags.type": "DELETE" } } } } } } } 

NOTE. Your strings are “not parsed” and you searched for “delete” instead of “DELETE”. If you want to look for case insensitivity, parse your strings.