CODEWITHSUNDEEP
elasticsearch
Apoorv Gupta
Apoorv Gupta

Reputation: 399

Exclude results based on key in elasticsearch

I have the below mapping for a type in elastic search:

"properties": {
    "userid": {
      "type": "integer"
    },
    "engid": {
      "type": "short"
    },
    "score": {
      "type": "short",
    },
    "name": {
      "type": "string",
      "index": "not_analyzed"
    },
    "submitTime": {
      "type": "date",
      "format": "yyyy-MM-dd HH:mm:ss"
    }

}

And my search query as:

{
  "size": 10,
  "query": {
    "filtered": {
      "query": {
        "match_all": {}
      },
      "filter": {
        "range": {
          "submitTime": {
            "gt": "now-18d"
          }
        }
      }
    }
  },
  "aggs": {
    "name": {
      "terms": {
        "field": "name",
        "order": {
          "_term": "asc"
        }
      },
      "aggs": {
        "score": {
          "terms": {
            "field": "score"
          }
        }
      }
    }
  }
}

This is giving my expected result as:

"aggregations": {
      "name": {
         "doc_count_error_upper_bound": 0,
         "sum_other_doc_count": 0,
         "buckets": [
            {
               "key": "---",
               "doc_count": 169529,
               "score": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": 0,
                        "doc_count": 160133
                     },
                     {
                        "key": 5,
                        "doc_count": 9395
                     },
                     {
                        "key": 4,
                        "doc_count": 1
                     }
                  ]
               }
            },
            {
               "key": "John",
               "doc_count": 1,
               "score": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": 5,
                        "doc_count": 1
                     }
                  ]
               }
            }

Now I want to remove the bucket from my results where name='---'. I tried using 'not', but it didn't worked. Any hint will be appreciated.

PS: I am new to elasticsearch, and just trying to expand my knowledge.

Upvotes: 0

Views: 258

Answers (1)

Val
Val

Reputation: 217554

You need to exclude the --- value in your query

{
  "size": 10,
  "query": {
    "filtered": {
      "query": {
        "match_all": {}
      },
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "submitTime": {
                  "gt": "now-18d"
                }
              }
            }
          ],
          "must_not": [
            {
              "term": {
                "name": "---"
              }
            }
          ]
        }
      }
    }
  },
  "aggs": {
    "name": {
      "terms": {
        "field": "name",
        "order": {
          "_term": "asc"
        }
      },
      "aggs": {
        "score": {
          "terms": {
            "field": "score"
          }
        }
      }
    }
  }
}

Upvotes: 2

Related Questions