如何查询所有嵌套字段为空的数据？弹性搜索 v.7

Question

我正在尝试从索引中获取城市为空的所有记录。

来源看起来像：

  "_index": "potatos_index",
            "_type": "_doc",
            "_id": "1240862",
            "_score": 14.41736,
            "_source": {
                "accountNumber": "1121212",
                "accountType": "Customer",
                "currency": "USD",
                "country": "USA",
                "cities": null,
           }


      "_index": "potatos_index",
                "_type": "_doc",
                "_id": "1240862",
                "_score": 14.41736,
                "_source": {
                    "accountNumber": "1121212",
                    "accountType": "Customer",
                    "currency": "USD",
                    "country": "USA",
                    "cities": [
                        {
                            "id": "1111",
                            "globalId": "1111"
                        }],
               }

因此，当我尝试仅搜索那些具有 cities: null 的来源时，我收到了不同类型的错误。

must_not + 存在 returns 个包含非空城市的来源。

我尝试了不同类型的脚本来过滤数据但没有结果。

_mapping 请求，城市类型为嵌套。

"cities": {
                    "type": "nested",
                    "properties": {

请指教

Answer 1

您是否以嵌套方式编写了 exists 查询？

{
    "query": {
     "bool" : {
      "must_not": [
      "nested": {
        "path": "cities",
        "query": {
                "exists": {
                  "field": "cities"
                }
        }
      } ]
    }
   }
}

基于此discussion

如何查询所有嵌套字段为空的数据？弹性搜索 v.7

How to query all data that has null nested field ? Elastic Search v.7

opensearch

elasticsearch

kibana

elasticsearch-5