not equal query in elasticsearch

Question

I have a field in my index contain a string data.. I run dsl query below expected documents which category fields is not equal to "-" character.. but as you see pic it returns.. What is the way of retrieve these data ?

GET webproxylog/_search
{
  "query": {
    "filtered": {
      "query": {"match_all": {}},
      "filter": {
        "not": {
          "filter": {
            "term": {
              "category": "-"
            }
          }
        }
      }
    }
  }
}

mappings:

{
   "webproxylog": {
      "mappings": {
         "accesslog": {
            "properties": {
               "category": {
                  "type": "string"
               },
               "clientip": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "clientmac": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "clientname": {
                  "type": "string"
               },
               "duration": {
                  "type": "long"
               },
               "filetype": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "hierarchycode": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "loggingdate": {
                  "type": "date",
                  "format": "dateOptionalTime"
               },
               "reqmethod": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "respsize": {
                  "type": "long"
               },
               "resultcode": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "url": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "user": {
                  "type": "string",
                  "index": "not_analyzed"
               }
            }
         }
      }
   }
}

In your screen shot the filter is "category": "", try again with the correct filter? Also make sure the string field is not_analyzed. — NikoNyrh
– NikoNyrh, Commented Oct 1, 2015 at 7:29
yes I recapt it, and yes all my field types are not_analyzed — user4005632
– user4005632, Commented Oct 1, 2015 at 7:30
I tried with POST, could not reproduce at ES 1.7.1 with not_analyzed field but I see this behavior if the field is analyzed. — NikoNyrh
– NikoNyrh, Commented Oct 1, 2015 at 7:40
@NikoNyrh I use 1.7.1 too and all my fields not_analyzed. I think even its analyzed, token data would be "-". So it doenst matter actually. let me share mapping. — user4005632
– user4005632, Commented Oct 1, 2015 at 7:47

NikoNyrh · Accepted Answer · 2015-10-01 08:01:30Z

My test with ES 1.7.1:

{
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0
  },
  "mappings": {
    "user": {
      "properties": {
        "number": { "type": "integer" },
        "name": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}

docs:

{"number":1, "name":"abc"}
{"number":2, "name":"-"}

Query:

{
  "size": 2,
  "query": {
    "filtered": {
      "filter": {
        "not": {
          "term": {
            "name": "-"
          }
        }
      }
    }
  }
}

Result:

{
    took: 1
    timed_out: false
    _shards: {
        total: 1
        successful: 1
        failed: 0
    }
    hits: {
        total: 1
        max_score: 1
        hits: [
            {
                _index: test_index
                _type: user
                _id: AVAiYtEjMfj2vcjSSqVr
                _score: 1
                _source: {
                    number: 1
                    name: abc
                }
            }
        ]
    }
}

Without "index": "not_analyzed" I see the reported behavior, I didn't check how "-" gets tokenized in that case (forgot the query to do that :P)

Collectives™ on Stack Overflow

not equal query in elasticsearch

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related