How to check if a value does not exist in elasticsearch attribute? - json

Question

I have a json object with system environments. I need to list out that percolator if environment variable does not contain a variable name "JAVA_HOME" and also if JAVA_HOME's value is not present in PATH variable. Is this possible in Elasticsearch?
below is my percolator
PUT /eg/.percolator/2
{
"query": {
"filtered": {
"query": {
"bool": {
"must": [
{
"match": {
"client.name": "Athena"
}
},
{
"match": {
"client.environment.variable.#name": "JAVA_HOME"
}
}
]
}
}
}
}
}
my doc
GET /eg/message/_percolate
{
"doc": {
"client": {
"name": "Athena",
"environment": {
"variable": [
{
"#name": "JAVA_HOME",
"#value": "/home/vikrant/Linux/Sandra/java"
},
{
"#name": "PATH",
"#value": "/bin:/sbin:/usr/bin:/usr/sbin:/home/vikrant/Linux/FAS611:/home/vikrant/Linux/FAS611/odbc:/home/vikrant/Linux/Sandra/java/bin:/home/vikrant/Linux/Sandra/server/bin:.:/bin:/usr/bin:/sbin:/usr/sbin:/usr/bin/X11:/usr/local/bin:/usr/local/etc:/etc:/usr/etc:.:/databases/ORACLE/bin:/databases/SYBASE/OCS-15_0/bin:/databases/DB2/bin:/usr/odbc/bin"
}
]
}
}
}
}

Answer 1

You need nested mapping first since your docs have nesting. This is the mapping that I first created for your docs to make things work:
{
"nested_exp": {
"properties": {
"client": {
"type": "nested",
"properties": {
"environment": {
"type": "nested",
"properties": {
"variable": {
"type": "nested",
"properties": {
"#name": {
"type": "string"
},
"#value": {
"type": "string"
}
}
}
}
},
"name": {
"type": "string"
}
}
}
}
}
}
Then I changed your provided query to make it work as you expected:
{
"query": {
"filtered": {
"query": {
"bool": {
"must": [
{
"nested": {
"path": "client",
"query": {
"match": {
"client.name": "Athena"
}
}
}
},
{
"nested": {
"path": "client.environment.variable",
"query": {
"match": {
"client.environment.variable.#name": "JAVA_HOME"
}
}
}
}
]
}
}
}
}
}
Coming to your question, it has two parts.
For the first part, you can use the NOT filter with nested match filter. Something like this:
{
"query": {
"filtered": {
"query": {
"bool": {
"must": [
{
"nested": {
"path": "client",
"query": {
"match": {
"client.name": "Athena"
}
}
}
},
{
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"not": {
"filter": {
"nested": {
"path": "client.environment.variable",
"query": {
"match": {
"client.environment.variable.#name": "JAVA_HOME"
}
}
}
}
}
}
}
}
]
}
}
}
}
}
I just tried on my local Elasticsearch server and it works like a charm.
The second one seems difficult to implement with Elasticsearch only as what you what to query is something like value of 1 variable should not be present in another variable's value.