Using `not` filter in Elasticsearch

Question

I have the following query in ElasticSearch. I am trying to filter out documents where the field message_class equals 'SE'.

I have referred to this SO Q&A, amongst other things, but the query below still returns documents that have the field message_class equaling 'SE'.

What is the correct way to use the not filter?

POST _search
{  
   "query":{  
      "filtered":{  
         "filter":{  
            "not":{  
               "term":{  
                  "message_class":"SE"
               }
            }
         }
      }
   }
}

The _mapping for the field message_class shows:

    "message_class" : {
      "full_name" : "message_class", "mapping" : {"message_class":{"type":"string"}}
    }

What is your mapping for the `message_class` field ? To use a `term` filter, you usually need a non-analyzed field. — mguillermin, Feb 03 '15 at 13:01
@mguillermin I have added the information to the question, thanks. Not sure how to interpret it though. Would appreciate your help there. What other filter could I use instead? — mydoghasworms, Feb 03 '15 at 13:36
Just a note: in general you should avoid using `not` filter - use `bool` filter with `must_not` clause instead http://www.elasticsearch.org/blog/all-about-elasticsearch-filter-bitsets/ — Konstantin V. Salikhov, Feb 03 '15 at 13:40

score 1 · Accepted Answer · answered Feb 03 '15 at 13:37

As you are using the term query , the analyzer is not applied on your query. Assuming that lowercase filter is applied , the following should work fine -

POST _search
{  
   "query":{  
      "filtered":{  
         "filter":{  
            "not":{  
               "term":{  
                  "message_class":"se"
               }
            }
         }
      }
   }
}

Using `not` filter in Elasticsearch

1 Answers1