I have a record like
"log": {
"Level": null,
"Message": "blah",
"StackTrace": "{}"
}
I have tried something like
{
"query": {
"bool": {
"must_not": [{
"match": {
"log.StackTrace": {
"query": "{}",
"type": "phrase"
}
}
}]
}
}
}
But still can't exclude this record from the search result
Make it a term query inside the must_not clause and use log.StackTrace.Keyword as the field
{ "query": { "bool": { "must_not": { "term" { "log.StackTrace.keyword": "{}" } } }}