nested select query in elasticsearch

Question

I have to convert the following query in elasticsearch :

select * from index where observable not in (select observable from index where tags = 'whitelist')

I read that I should use a Filter in a Not Filter but I don't understand how to do. Can anyone help me? Thanks

EDIT:

I have to get all except those that have 'whitelist' tag but I need to check also that nothing of the blacklist element is contained into the whitelist.

Answer 1

Your SQL query can be simplified to this:

select * from index where tags not in ('whitelist')

As a result the "corresponding" ES query would be

curl -XPOST localhost:9200/index/_search -d '{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must_not": {
            "terms": {
              "tags": [
                "whitelist"
              ]
            }
          }
        }
      }
    }
  }
}'

or another using the not filter instead of bool/must_not :

curl -XPOST localhost:9200/index/_search -d '{
  "query": {
    "filtered": {
      "filter": {
        "not": {
          "terms": {
            "tags": [
              "whitelist"
            ]
          }
        }
      }
    }
  }
}'