Elasticsearch Must_not with exists query on nested object returns excluded field

Question

I am using ElasticSearch version 7.17 querying using the search API that it has. The data inside my index in ElasticSearch is loaded from an SQL database using Logstash. In the query, I use the must_not exists query to get documents where there's no email_list in a group within a class. My mapping and data are like this,

{
    "class": {
        "properties": {
            "id": {
                "type": "long"
            },
            ...
            "status": {
                "type": "long"
            },
            "group": {
                "type": "nested",
                "properties": {
                    "id": {
                        "type": "long"
                    },
                    "email_list": {
                        "type": "keyword"
                    },
                    ...
                }
            }
        }
    }
}

{
    "class": {
        "id": "15",
        ...
        "status": 1,
        "group": {
            "id": 100,
            ...
            "email_list": [
                "[email protected]",
                "[email protected]",
                "[email protected]"
            ]
        },
    }
}

So far, I've tried several queries, including with the nested query, these are some queries I've tried,

{
    "query": {
        "bool": {
            "must_not": [
                {
                    "exists": {
                        "field": "class.group.email_list"
                    }
                }
            ]
        }
    }
}

{
    "query": {
        "bool": {
            "must_not": [
                {
                    "nested": {
                        "path": "class.group",
                        "query": {
                            "exists": {
                                "field": "email_list"
                            }
                        }
                    }
                }
            ]
        }
    }
}

However, those queries always return documents with email_list inside it. Am I doing something wrong? Any help would be great

Thanks

Answer 1

You need to use full field name class.group.email_list in your nested query. Below query will give you expected result.

{
  "query": {
    "bool": {
      "must_not": [
        {
          "nested": {
            "path": "class.group",
            "query": {
              "exists": {
                "field": "class.group.email_list"
              }
            }
          }
        }
      ]
    }
  }
}