Elasticsearch 查询多字段术语和多字段不能匹配查询

Question

My requirement is below:

1. I need to use multiple fields for must_not match conditions
2. I need to use multiple fields in terms query

When I run the below query, Getting the following error for Must_not

"reason": "[match] query doesn't support multiple fields, found [app_rating] and [satisfaction_rating]"

And for the Terms multiple fields also getting the error.

"reason": "Expected [START_OBJECT] under [should], but got a [START_ARRAY] in [MyBuckets]",

How can I correct the query?

  "size":0,
  "_source":["comments.keyword"],
    "query":{
    "bool": {
      "must": [
        {"match":{"source.keyword": "ONA"}}
      
      ],
    "must_not":[
      
      {"match":{"app_rating":"0","satisfaction_rating":"0","usability_rating": "0"}}
      ]
    }
},
"aggs": {
  "MyBuckets": {
    "should":[{
    "terms": {
      "fields": ["comments.keyword"]
    }
    },
    {
      "terms":{
        "fields": ["app_rating"]
      }
    },
    {
      "terms":{
        "fields": ["satisfaction_rating"]
      }
    },
    {
      "terms":{
        "fields": ["usability_rating"]
      }
      
    }
    ],
      "order":{
        "_count": "desc"
      },
      "size": "10"

}
}
}

** Below is the sample Mapping details**
'''{
  "mapping": {
    "properties": {
      "Id": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
}
        }
      },
      "app_rating": {
        "type": "long"
      },
"comments": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
"conversation_rating": {
        "type": "long"
      },
      "id": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
}
        }
      },
      "satisfaction_rating": {
        "type": "long"
      },
"source": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },
"timestamp": {
        "type": "long"
      },
      "usability_rating": {
        "type": "long"
      }
    }
  }
}

Answer 1

You can't use multiple fields in a single must_not clause, so you have to add multiple must_not clause also you are trying to use terms aggregations on various terms and your syntax is not correct which is causing the exception.

can you provide your index mapping and sample docs, so that I can provide the working example.