Elasticsearch query must not match text from field

Question

I want to get the results that do not match "statusCode": 200

In order to match text from field you use

GET index01/_search?pretty
{
  "query":{
    "match":{
      "statusCode": 200
    }
  }
}

I tried something like this:

GET ucs_heartbeat/_search?pretty
{
  "query":{
    "match":{
      "statusCode":{
        "query": 200,
        "operator": "must_not"
      }
    }
  }
}

According to: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html

note that there is no operator called must_not for match query. Only available operators are and(default) and or. Consider using term query over match query for all structured fields like keyword, numbers — avr
– avr, Commented Apr 6, 2017 at 10:51

Val · Accepted Answer · 2017-04-06 10:33:58Z

37

Try this instead

GET ucs_heartbeat/_search?pretty
{
  "query": {
    "bool": {
      "must_not": [
        {
          "term": {
            "statusCode": 200
          }
        }
      ]
    }
  }
}

answered Apr 6, 2017 at 10:33

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

soumitra goswami Over a year ago

Hi, is it possible to perform this kind of search by using a regexp search(for a String -text and keyword- type field), something like- "bool":{"must":[{"regexp": {"statusCode.keyword": {"value": "~(200)","flags": "ALL"}}}]} , and also, is there any difference in performance, if this query works ?

Val Over a year ago

@soumitragoswami regexp queries are notably slower. If you know in advance what and how you're going to query you can prepare your data at indexing time so that regexp queries are not necessary anymore. Your mileage may vary, so you should definitely try it out and then if you hit performance issues, look for other possible indexing solutions. Feel free to create a new question with your specific issue, though

soumitra goswami Over a year ago

Hi, I created a question on this - stackoverflow.com/questions/59410594/…

NeilB · Accepted Answer · 2022-05-23 10:41:03Z

0

A possible string query could be:

{
    "query": {
        "query_string": {
            "query": "NOT statusCode: 200"
        }
    },
    "size": 10,
    "from": 0,
    "sort": []
}

answered May 23, 2022 at 10:41

NeilB

3573 silver badges19 bronze badges

Collectives™ on Stack Overflow

Elasticsearch query must not match text from field

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related