CODEWITHSUNDEEP
pythonelasticsearch
mikhil mohanan
mikhil mohanan

Reputation: 147

elastic query where field is null in elastic

i am trying to write a query where it searches in elastic that a particular field is null.this query us executed in python using Python Elasticsearch Client.

query:

{
    "_source": ["name"],
    "query": {
                "nested": {
                    "path": "experience",
                    "query": {
                        "match": {
                            "experience.resignation_date": {
                                "query": None
                            }
                        }
                    }
                }
            }
}

since its python i have used None in the query part but it throwing me this error.

elasticsearch.exceptions.RequestError: TransportError(400, 'parsing_exception', '[match] unknown token [VALUE_NULL] after [query]')

Upvotes: 4

Views: 3869

Answers (2)

Val
Val

Reputation: 217294

The missing query is deprecated, you're looking for bool/must_not + exists

{
  "_source": [
    "name"
  ],
  "query": {
    "nested": {
      "path": "experience",
      "query": {
        "bool": {
          "must_not": {
            "exists": {
              "field": "experience.resignation_date"
            }
          }
        }
      }
    }
  }
}

Upvotes: 6

HellaWiggly
HellaWiggly

Reputation: 182

With this expression you're not querying for null, you're saying use null as the query.

Query must always be one of the query types that ElasticSearch has defined, such as for example the "match" query.

The kind of syntax you wanted to write here was

query: {
    match: {
        "experience.resignation_date": None
    }
}

Where you are asserting that the value matches "None"

However, there is a better specific query type for matching documents with empty field values called "missing".

It will match null fields as well as documents which lack the property all together. Whether this is more appropriate for you depends on your needs.

EDIT: As a subsequent answer points out "missing" is actually deprecated now. The equivalent is to negate the "exists" query instead.

query: {
    bool: {
        must_not: {
            exists: "experience.resignation_date"
        }
    }
}

Upvotes: 2

Related Questions