Find empty strings in elasticsearch

Question

I'm trying to _search documents that has some specific value in the field.

{
  "query": {
      "bool": {
        "must": [
         {"field": {"advs.status": "warn"}}
       ]
      }
  }
}

That works find. But when I'm trying to find documents that has empty string in that field, I get this error:

ParseException[Cannot parse '' ...

and then - long list of what was expected instead of empty string.

I try this query:

{
  "query": { 
    "bool": {
        "must": [
            {"term": {"advs.status": ""}}
         ]
        }
  }
}

It doesn't fails but finds nothing. It works for non empty strings instead. How am I supposed to do this?

My mapping for this type looks exactly like this:

{
    "reports": {
        "dynamic": "false",
        "_ttl": {
            "enabled": true,
            "default": 7776000000
        },
        "properties": {
            "@fields": {
                "dynamic": "true",
                "properties": {
                    "upstream_status": {
                        "type": "string"
                    }
                }
            },
            "advs": {
                "properties": {
                    "status": {
                        "type": "string",
                        "store": "yes"
                    }
                }
            },
            "advs.status": {
                "type": "string",
                "store": "yes"
            }
        }
    }
}

How can I enable syntax highlighting for json?

Evgeny Lazin
– Evgeny Lazin

2013-08-09 17:12:03 +00:00
Commented Aug 9, 2013 at 17:12 — Evgeny Lazin
– Evgeny Lazin, Commented Aug 9, 2013 at 17:12

bensie · Accepted Answer · 2013-08-09 17:28:36Z

6

Or another way to do the same thing more efficiently is to use the exists filter:

"exists" : {
  "field" : "advs.status"
}

Both are valid, but this one is better :)

answered Aug 9, 2013 at 17:28

bensie

5,4131 gold badge34 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Gabriel Wamunyu · Accepted Answer · 2017-12-08 05:50:41Z

2

You can try this temporary solution which works but isn't optimal - https://github.com/elastic/elasticsearch/issues/7515

PUT t/t/1
{
"textContent": ""
}

PUT t/t/2
{
 "textContent": "foo"
}

GET t/t/_search
{
 "query": {
  "bool": {
   "must": [
    {
      "exists": {
        "field": "textContent"
      }
    }
  ],
  "must_not": [
    {
      "wildcard": {
        "textContent": "*"
      }
     }
   ]
  }
 }
}

answered Dec 8, 2017 at 5:50

Gabriel Wamunyu

75411 silver badges28 bronze badges

Comments

bensie · Accepted Answer · 2013-08-09 17:21:35Z

1

Try using must_not with missing in your bool:

"must_not":{
  "missing":{
    "field":"advs.status",
    "existence":true,
    "null_value":true
  }
}

answered Aug 9, 2013 at 17:21

bensie

5,4131 gold badge34 silver badges34 bronze badges

1 Comment

David L Over a year ago

Could you combine the two answers into one?

VirgileD · Accepted Answer · 2015-03-12 12:44:21Z

1

If tou want to search for fields containing an empty string, either you change your mapping to set not_analyzed to this particular field or you can use a script filter:

"filter": {
  "script": {
    "script": "_source.advs.status.length() == 0"
  }
}

answered Mar 12, 2015 at 12:44

VirgileD

7671 gold badge7 silver badges23 bronze badges

Comments

James-Jesse Drinkard · Accepted Answer · 2016-06-28 20:54:37Z

1

I generally use a filter if the field is not analyzed. Here is snippet:

{
  "filtered": {
    "filter": {
      "term": {
        "field": ""
      }
    }
  }
},

answered Jun 28, 2016 at 20:54

James-Jesse Drinkard

15.8k16 gold badges120 silver badges141 bronze badges

Comments

Community · Accepted Answer · 2017-05-23 12:16:09Z

0

the "missing" does work only for null values or not being there at all. Matching empty string was already answered here: https://stackoverflow.com/a/25562877/155708

edited May 23, 2017 at 12:16

CommunityBot

11 silver badge

answered Apr 10, 2015 at 9:32

Jakub

2,4042 gold badges22 silver badges20 bronze badges

Collectives™ on Stack Overflow

Find empty strings in elasticsearch

6 Answers 6

Comments

Comments

1 Comment

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

Comments

Comments

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related