Elasticsearch exclude association of multiple terms

Question

I need to exclude from my search an association of different terms. Is there any clever way to do this kind of multi-term-exclusion?

Example: say I want to get all users Except the ones whose (last name is Doe ) and (first name is John or Annie or without any first name value).

Expected results example:

first_name | last_name | Search result
--------------------------------------
Bob        | Doe       | appears
--------------------------------------
Annie      | Doe       | excluded 
--------------------------------------
(null)     | Doe       | excluded 
--------------------------------------
John       | Foo       | appears 
--------------------------------------
(null)     | Foo       | appears 

So far the best I did was the following request, but it does not work: in our example this request will exclude everyone whose last name is Doe, whatever the first name… and I cannot understand why?

GET user/_search
{
  "query": {
    "bool": {
      "must_not": [
        {
          "bool": {
            "must": [
              {
                "term": {
                  "last_name": "Doe"
                }
              }
            ]
          }
        },
        {
          "bool": {
            "should": [
              {
                "bool": {
                  "must": [
                    {
                      "terms": {
                        "first_name": [
                          "John",
                          "Annie"
                        ]
                      }
                    }
                  ]
                }
              },
              {
                "bool": {
                  "must_not": {
                    "exists": {
                      "field": "first_name"
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}

Any help of an Elastic-sharp-eye on this will be much appreciated!

Answer 1

In must_not array document must not match any of the clause. Your query basically translates to don't consider a document if last_name is Doe OR (first_name is annie or john or doesn't exists)

To work as AND place your query in bool

{
  "query": {
    "bool": {
      "must_not": [
        {
          "bool": {
            "must": [
              {
                "match": {
                  "last_name": "Doe"
                }
              },
              {
                "bool": {
                  "should": [
                    {
                      "terms": {
                        "first_name.keyword": [
                          "John",
                          "Annie"
                        ]
                      }
                    },
                    {
                      "bool": {
                        "must_not": {
                          "exists": {
                            "field": "first_name"
                          }
                        }
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}