Find documents with empty string value on elasticsearch

Question

I've been trying to filter with elasticsearch only those documents that contains an empty string in its body. So far I'm having no luck.

Before I go on, I should mention that I've already tried the many "solutions" spread around the Interwebz and StackOverflow.

So, below is the query that I'm trying to run, followed by its counterparts:

{     "query": {         "filtered":{             "filter": {                 "bool": {                     "must_not": [                         {                             "missing":{                                 "field":"_textContent"                             }                         }                     ]                 }             }         }     } } 

I've also tried the following:

 {     "query": {         "filtered":{             "filter": {                 "bool": {                     "must_not": [                         {                             "missing":{                                 "field":"_textContent",                                 "existence":true,                                 "null_value":true                             }                         }                     ]                 }             }         }     } } 

And the following:

   {     "query": {         "filtered":{             "filter": {                     "missing": {"field": "_textContent"}             }         }     } } 

None of the above worked. I get an empty result set when I know for sure that there are records that contains an empty string field.

If anyone can provide me with any help at all, I'll be very grateful.

Thanks!

Answer 1

If you are using the default analyzer (standard) there is nothing for it to analyze if it is an empty string. So you need to index the field verbatim (not analyzed). Here is an example:

Add a mapping that will index the field untokenized, if you need a tokenized copy of the field indexed as well you can use a Multi Field type.

PUT http://localhost:9200/test/_mapping/demo {   "demo": {     "properties": {       "_content": {         "type": "string",         "index": "not_analyzed"       }     }   } } 

Next, index a couple of documents.

/POST http://localhost:9200/test/demo/1/ {   "_content": "" }  /POST http://localhost:9200/test/demo/2 {   "_content": "some content" } 

Execute a search:

POST http://localhost:9200/test/demo/_search {   "query": {     "filtered": {       "filter": {         "term": {           "_content": ""         }       }     }   } } 

Returns the document with the empty string.

{     took: 2,     timed_out: false,     _shards: {         total: 5,         successful: 5,         failed: 0     },     hits: {         total: 1,         max_score: 0.30685282,         hits: [             {                 _index: test,                 _type: demo,                 _id: 1,                 _score: 0.30685282,                 _source: {                     _content: ""                 }             }         ]     } } 

Answer 2

Found solution here https://github.com/elastic/elasticsearch/issues/7515 It works without reindex.

PUT t/t/1 {   "textContent": "" }  PUT t/t/2 {   "textContent": "foo" }  GET t/t/_search {   "query": {     "bool": {       "must": [         {           "exists": {             "field": "textContent"           }         }       ],       "must_not": [         {           "wildcard": {             "textContent": "*"           }         }       ]     }   } }