Note that there are some explanatory texts on larger screens.

plurals
  1. POHow can I identify missing documents in ElasticSearch?
    text
    copied!<p><strong>Background</strong>:</p> <p>In my ElasticSearch index, I have two types of documents that can be identified as 'bvi_ship' and 'bvi_notify'. Each document that is identified as 'bvi_ship' should also have a corresponding document identified as 'bvi_notify'. </p> <p><strong>Question</strong>:</p> <p>What is an appropriate way of identifying the 'bvi_ship' documents that don't have a 'bvi_notify' document?</p> <p><strong>Using Facet</strong>:</p> <p>I've been able to identify the necessary documents using the following faceted code:</p> <pre><code>{ "size":0, "query":{ "filtered":{ "query":{ "query_string":{ "default_operator":"OR", "default_field":"_all", "query":"@fields.action:\"bv_ship\" OR @fields.action:\"bvi_notify\"" } } } }, "facets":{ "terms":{ "terms":{ "field":[ "@fields.object" ], "size":1000 } } } } </code></pre> <p>Which returns results that look like this:</p> <pre><code>{ "took" : 147, ... }, "hits" : { ... }, "facets" : { "terms" : { ... "terms" : [ { "term" : "xml", "count" : 1443 }, { "term" : "content_ff47d2d096ea4510ac0895941666e507", "count" : 2 }, { "term" : "content_fa525becb2724b7682df278c02fed308", "count" : 2 }, ... THOUSANDS OF RECORDS WITH COUNT of 2 }, { "term" : "content_f1ff2f7440534a08bad4c62b92165949", "count" : 1 } ] } } } </code></pre> <p>This <em>could</em> work well, but I obviously don't want to return thousands of records that have a count of 2 when I am really only interested in the records that have a count of 1.</p> <p>Is there a way to limit the faceted search so that it only returns the records with a count of 1?</p> <p><strong>Using Filter</strong>:</p> <p>I'm guessing I should be able to be more specific in my query and simply select the appropriate records using a combination of Queries and Filters, though my ElasticSearch Kung-Fu is being handicapped by my Relational Database Karate. </p>
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload