ElasticSearch search for empty fields

Question

I have added a new nested object field to a elastic search index. I want to update the field with some default value like [ {"key": "xyz", "value": "val1"}]. I am trying to query the index where the field value is empty or null, but was not successful.

I have tried this

"bool": {
  "must_not": {
    "exists": {
      "field": "PropertyFields"
    }
  }
}

sample data

[
  {
    "Id": 1,
    "subjectPropertyFields": [
      {
        "value": "xyz",
        "key": "zzz"
      }
    ]
  },
  {
    "Id": 2
  },
  {
    "Id": 3
  }
]

I want to query ids 2,3 .

Answer 1

If you want to find documents that are missing a nested object field, you can use the must_not boolean query with the exists query.

Adding a working example with index data, mapping, search query, and search result

Index Mapping:

  {
  "mappings": {
    "properties": {
      "subjectPropertyFields": {
        "type": "nested"
      }
    }
  }
}

Index Data:

{
    "Id": 1,
    "subjectPropertyFields": [
      {
        "value": "xyz",
        "key": "zzz"
      }
    ]
  }
  {
    "Id": 2
  }
  {
    "Id": 3
  }

Search Query:

 {
  "query": {
    "bool": {
      "must_not": [
        {
          "nested": {
            "path": "subjectPropertyFields",
            "query": {
              "bool": {
                "filter": {
                  "exists": {
                    "field": "subjectPropertyFields"
                  }
                }
              }
            }
          }
        }
      ]
    }
  }
}

Search Result:

"hits": [
      {
        "_index": "65047473",
        "_type": "_doc",
        "_id": "2",
        "_score": 0.0,
        "_source": {
          "Id": 2
        }
      },
      {
        "_index": "65047473",
        "_type": "_doc",
        "_id": "3",
        "_score": 0.0,
        "_source": {
          "Id": 3
        }
      }
    ]