How to combine must and must_not in elasticsearch with same field

Question

i have elasticsearch 6.8.8, just for an example of my question. I want to create a query that gets me document with "Test" field with value "1", and i don't want to get "Test" field with value of "3", i know that i could write just the first expression without 3 and it will give me one document with value of "1". But i want to know, is there any way, that i can use must and must_not in the same time, on the same field and getting just the value of "1"?

I wrote this basic example to know what i mean:

{
"from": 0,
"query": {
    "nested": {
        "path": "attributes",
        "query": {
            "bool": {
                "should": [
                    {
                        "bool": {
                            "must": [
                                {
                                    "match": {
                                        "attributes.key": {
                                            "query": "Test"
                                        }
                                    }
                                },
                                {
                                    "match": {
                                        "attributes.value": {
                                            "query": "1"
                                        }
                                    }
                                }
                            ],
                            "must_not": [
                                {
                                    "match": {
                                        "attributes.key": {
                                            "query": "Test"
                                        }
                                    }
                                },
                                {
                                    "match": {
                                        "attributes.value": {
                                            "query": "3"
                                        }
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        }
    }
}

}

I use attributes as nested field with key-value field that use mapping as string type.

Answer 1

You'll need to leave out attributes.key:Test in the must_not because it filters out all Tests:

GET combine_flat/_search
{
  "from": 0,
  "query": {
    "nested": {
      "inner_hits": {}, 
      "path": "attributes",
      "query": {
        "bool": {
          "should": [
            {
              "bool": {
                "must": [
                  {
                    "match": {
                      "attributes.key": {
                        "query": "Test"
                      }
                    }
                  },
                  {
                    "match": {
                      "attributes.value": {
                        "query": "1"
                      }
                    }
                  }
                ],
                "must_not": [
                  {
                    "match": {
                      "attributes.value": {
                        "query": "3"
                      }
                    }
                  }
                ]
              }
            }
          ]
        }
      }
    }
  }
}

Tip: use inner_hits to just return the matched nested key-value pairs as opposed to the whole field.