Elasticsearch query_string和term组合不起作用

Question

I've written the following query in order to search documents which have "test" in "message" field AND their length is between 20 and 200 AND none of "user*" are "admin" AND "user3" to "user20" are NULL all sorted by "date" .

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "test",
            "default_field": "message"
          }
        },
        {
          "term": {
            "user20": "NULL"
          }
        },
        {
          "term": {
            "user19": "NULL"
          }
        },
        {
          "term": {
            "user18": "NULL"
          }
        },
        {
          "term": {
            "user17": "NULL"
          }
        },
        {
          "term": {
            "user16": "NULL"
          }
        },
        {
          "term": {
            "user15": "NULL"
          }
        },
        {
          "term": {
            "user14": "NULL"
          }
        },
        {
          "term": {
            "user13": "NULL"
          }
        },
        {
          "term": {
            "user12": "NULL"
          }
        },
        {
          "term": {
            "user11": "NULL"
          }
        },
        {
          "term": {
            "user10": "NULL"
          }
        },
        {
          "term": {
            "user9": "NULL"
          }
        },
        {
          "term": {
            "user8": "NULL"
          }
        },
        {
          "term": {
            "user7": "NULL"
          }
        },
        {
          "term": {
            "user6": "NULL"
          }
        },
        {
          "term": {
            "user5": "NULL"
          }
        },
        {
          "term": {
            "user4": "NULL"
          }
        },
        {
          "term": {
            "user3": "NULL"
          }
        }
      ],
      "filter": [
        {
          "range": {
            "length": {
              "gte": 20,
              "lte": 200
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "user1": "admin"
          }
        },
        {
          "term": {
            "user2": "admin"
          }
        },
        {
          "term": {
            "user3": "admin"
          }
        },
        {
          "term": {
            "user4": "admin"
          }
        },
        {
          "term": {
            "user5": "admin"
          }
        },
        {
          "term": {
            "user6": "admin"
          }
        },
        {
          "term": {
            "user7": "admin"
          }
        },
        {
          "term": {
            "user8": "admin"
          }
        },
        {
          "term": {
            "user9": "admin"
          }
        },
        {
          "term": {
            "user10": "admin"
          }
        },
        {
          "term": {
            "user11": "admin"
          }
        },
        {
          "term": {
            "user12": "admin"
          }
        },
        {
          "term": {
            "user13": "admin"
          }
        },
        {
          "term": {
            "user14": "admin"
          }
        },
        {
          "term": {
            "user15": "admin"
          }
        },
        {
          "term": {
            "user16": "admin"
          }
        },
        {
          "term": {
            "user17": "admin"
          }
        },
        {
          "term": {
            "user18": "admin"
          }
        },
        {
          "term": {
            "user19": "admin"
          }
        },
        {
          "term": {
            "user20": "admin"
          }
        }
      ]
    }
  },
  "sort": [
    {
      "date": {
        "order": "desc"
      }
    }
  ]
}

without "user3" to "user20" are NULL condition the query works fine ie if I erase all corresponding parts in query. However, when I add those again, I get 0 results. I'm sure I have documents meeting the criteria.

What's the problem? Any suggestions?

Answer 1

The question is: How you defined the null value in the mapping? As you wrote in query it will work only if you set "null_value": "NULL" in the mapping. Other way you can use "exists" or "missing" queries like : "exists" : { "field" : "user20" } Can you provide the example of document please?