how elasticsearch exclude a specific value?

ElasticSearch: Exclude result where some value meets a condition

• I have some documents in elasticsearch like this {"id":1000, "user":"A", "type":["foo","bar"]} {"id":1001, "user":"B", "type":["bar"]} {"id":1002, "user":"C", "type":["foo"]} {"id":1003, "user":"A", "type":[]} {"id":1004, "user":"D", "type":["foo","bar"]} {"id":1005, "user":"E", "type":[]} {"id":1006, "user":"F", "type":["bar"]} I need to filter the users that no have in the field type the value "foo" so the expected result must be: {"id":1001, "user":"B", "type":["bar"]} {"id":1005, "user":"E", "type":[]} {"id":1006, "user":"F", "type":["bar"]} i tried with this query { "query": { "bool": { "must_not": [ { "query_string": { "default_field": "type", "query": "foo" } } ] } }, "from": 0, "size": 10 } but in the results i see the "user":"A" is there because a document has the value [] in "types" {"id":1003, "user":"A", "type":[]} but "user":"A" also has a document with "foo" in "type" {"id":1000, "user":"A", "type":["foo","bar"]} So there is a way to exclude those users? if an user have the value "foo" in any of the their documents this user can not be returned in the result.

• Answer:

  I don't think you can do what you are asking with the way you have your index set up. But if you can reorganize your index to take advantage of the https://www.elastic.co/guide/en/elasticsearch/guide/current/parent-child.html, it can probably solve your problem. Here is an example. I set up an index with two types, a parent type and a child type, as follows: PUT /test_index { "mappings": { "parent_doc": { "properties": { "user_name": { "type": "string" } } }, "child_doc":{ "_parent": { "type": "parent_doc" }, "properties": { "type_names": { "type": "string" } } } } } Then I took the data you posted and reorganized it like this (for empty lists I just didn't add a child doc): POST /test_index/_bulk {"index":{"_type":"parent_doc","_id":1}} {"user_name":"A"} {"index":{"_type":"child_doc","_parent":1}} {"type_names":["foo","bar"]} {"index":{"_type":"parent_doc","_id":2}} {"user_name":"B"} {"index":{"_type":"child_doc","_parent":2}} {"type_names":["bar"]} {"index":{"_type":"parent_doc","_id":3}} {"user_name":"C"} {"index":{"_type":"child_doc","_parent":3}} {"type_names":["foo"]} {"index":{"_type":"parent_doc","_id":4}} {"user_name":"D"} {"index":{"_type":"child_doc","_parent":4}} {"type_names":["foo","bar"]} {"index":{"_type":"parent_doc","_id":5}} {"user_name":"E"} {"index":{"_type":"parent_doc","_id":6}} {"user_name":"F"} {"index":{"_type":"child_doc","_parent":6}} {"type_names":["bar"]} The I can query all the users that do not have a child containing the term "foo" as follows: POST /test_index/parent_doc/_search { "filter": { "not": { "filter": { "has_child": { "type": "child_doc", "query": { "match": { "type_names": "foo" } } } } } } } which returns: { "took": 69, "timed_out": false, "_shards": { "total": 1, "successful": 1, "failed": 0 }, "hits": { "total": 3, "max_score": 1, "hits": [ { "_index": "test_index", "_type": "parent_doc", "_id": "2", "_score": 1, "_source": { "user_name": "B" } }, { "_index": "test_index", "_type": "parent_doc", "_id": "5", "_score": 1, "_source": { "user_name": "E" } }, { "_index": "test_index", "_type": "parent_doc", "_id": "6", "_score": 1, "_source": { "user_name": "F" } } ] } } Here is the code I used: http://sense.qbox.io/gist/bd2f4336b650c27013fdc2c64b8c1f649af1814e