CODEWITHSUNDEEP
elasticsearchkibana
André Herculano
André Herculano

Reputation: 1307

How to query for empty field or specific value

I'm trying write a query to achieve the following result:

field1: value1 AND 
field2: value2 OR "" (empty)

I've tried the following but it always returns me empty results:

{
  "_source": ["field1", "field2"], 
  "query": {
    "bool": {
      "must": [
        {"match": { "field1": "value1" }},
        {
          "bool": {
            "should": [
              { 
                "match": {
                  "field2": "value2"
                }
              }
            ],
            "must_not": [
              {
                "exists": { "field": "field2" }
              }
            ]
          }
        }
      ]
    }
  }
}

I believe I'm making a query that contradicts itself.

Upvotes: 1

Views: 6659

Answers (1)

gaurav9620
gaurav9620

Reputation: 1197

This is looking very complicated.

Try using queryStringQuery Try rewriting your query like this

{
    "_source": ["field1", "field2"], 
    "query": {
      "query_string": {
        "query": "field1:value1 AND (field2:value2 OR (!field2:*))"
      }
    }

}

If you still want to use in this format

You have used must_not clause which would mean somewhat this as below according to your use case.

field1: value1 AND

field2: value2 AND NOT "" (empty)

What you should do is 

   {
  "_source": [
    "field1",
    "field2"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "field1": "value1"
          }
        },
        {
          "bool": {
            "should": [
              {
                "match": {
                  "field2": "value2"
                }
              },
              {
                "bool": {
                  "must_not": [
                    {
                      "exists": {
                        "field": "field2"
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}

But it would be more easy for you to use queryString if you want to analyze the terms in query first which you have done in your query.

So using queryString OR bool in your this case would be same

Upvotes: 4

Related Questions