Elasticsearch 7.0: filter must_not query error

Question

I am using elasticsearch-py 7.0 and elasticsearch server 7.0 on a windows 8 machine.

I have this query:

{
    'size': 10000, 
    'query': {
        'bool': {'must_not': {'filter': [{'term': {'status': 'ok'}}]}
        }
    }
}

The mapping is this:

  "mappings": {
      "properties": {
         "name": {"type": "text"},
         "status": {"type": "keyword"},
         "date": {"type":"date"}
      }
    }

It follows the rules specified in the docs for boolean query but it doesn't work because it throws a syntax error:

RequestError: RequestError(400, 'parsing_exception', 'no [query] registered for [filter]')

However, if I remove the "must_not" element, it works:

{
    'size': 10000, 
    'query': {
        'bool': {'filter': [{'term': {'status': 'ok'}}]}
    }
}

What am I doing wrong here?

Answer 1

filter

The clause (query) must appear in matching documents. However unlike must the score of the query will be ignored. Filter clauses are executed in filter context, meaning that scoring is ignored and clauses are considered for caching.

must_not

The clause (query) must not appear in the matching documents. Clauses are executed in filter context meaning that scoring is ignored and clauses are considered for caching. Because scoring is ignored, a score of 0 for all documents is returned.

Both filter and must_not are clauses of the bool query and work in the same way. To use must_not then you need to remove filter :

{
  'size': 10000,
  'query': {
    'bool': {
      'must_not': {
        'term': {
          'status': 'ok'
        }
      }
    }
  }
}