I have documents in elastic with following format, where trunk value can be one of [1PCX05, 2PCX05, 3PCX05 6PCX05]

 "doc": {
      "keys": {
        "trunk": "6PCX05",
        "direction": "incoming",
        "country": "CHN",
        "service": "ENTVTS",
        "company": "XYZ"
      }
}

But when I am running following query to filter documents on filtering company field and must_not -> terms with specific trunks but must_not cluase is not getting applied and i am getting all documents with company name "XYZ"

POST /my_index-*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "match": {
            "doc.keys.company": {
              "query": "XYZ",
              "operator": "OR",
              "prefix_length": 0,
              "max_expansions": 50,
              "fuzzy_transpositions": true,
              "lenient": false,
              "zero_terms_query": "NONE",
              "auto_generate_synonyms_phrase_query": true,
              "boost": 1
            }
          }
        }
      ],
      "must_not": [
        {
          "terms": {
            "doc.keys.trunk": [
              "3PCX05,2PCX05,1PCX05"
            ],
            "boost": 1
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  }
}

I also tried using keyword in doc.keys.trunk.keyword, but still not working

CodePudding user response：

TLDR;

Are you sure .keyword does not work ? For me it was very clear it was the way to fix the issue.

To Reproduce

I create a toy project to try to simulate your situation.

# Truck 1
POST /71188384/_doc
{
  "doc": {
    "keys": {
      "trunk": "6PCX05",
      "direction": "incoming",
      "country": "CHN",
      "service": "ENTVTS",
      "company": "XYZ"
    }
  }
}

# Truck 2
POST /71188384/_doc
{
  "doc": {
    "keys": {
      "trunk": "6PCX06",
      "direction": "incoming",
      "country": "CHN",
      "service": "ENTVTS",
      "company": "XYZ"
    }
  }
}


GET /71188384/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "match": {
            "doc.keys.company": {
              "query": "XYZ",
              "operator": "OR",
              "prefix_length": 0,
              "max_expansions": 50,
              "fuzzy_transpositions": true,
              "lenient": false,
              "zero_terms_query": "NONE",
              "auto_generate_synonyms_phrase_query": true,
              "boost": 1
            }
          }
        }
      ],
      "must_not": [
        {
          "terms": {
            "doc.keys.trunk.keyword": ["6PCX05"],
            "boost": 1
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  }
}

I do get successfully Truck 2

{
  ...
        "_source" : {
          "doc" : {
            "keys" : {
              "trunk" : "6PCX06",
              "direction" : "incoming",
              "country" : "CHN",
              "service" : "ENTVTS",
              "company" : "XYZ"
            }
          }
        }
     ...
}

Here is the mapping I have:

{
  "71188384" : {
    "aliases" : { },
    "mappings" : {
      "properties" : {
        "doc" : {
          "properties" : {
            "keys" : {
              "properties" : {
                "company" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "country" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "direction" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "service" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "trunk" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "settings" : {
      "index" : {
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "number_of_shards" : "1",
        "provided_name" : "71188384",
        "creation_date" : "1645309336806",
        "number_of_replicas" : "1",
        "uuid" : "5vw9ZKmYQ1aWh_Rs0ajckg",
        "version" : {
          "created" : "7160399"
        }
      }
    }
  }
}