TLDR -- how to query elasticsearch for records where 'value==1 or value not recorded'?
We use Elasticsearch for audit trails in a relatively new system. The auditing initially only applied to a single entity.
It was saved in Elasticsearch by creating a message, converting to json and storing. This was old record:
public class AuditMessage
{
public int EntityId { get; set; }
}
Now we wish to record audit trail for the next entity and we add enum to distinquish:
public class AuditMessage
{
public AuditHistoryEnum AuditHistoryEnum { get; set; }
public int EntityId { get; set; }
}
Finally we query like this:
var response = await _elasticClient.SearchAsync<AuditMessage>(_ => _
.Index(indices)
.From(0)
.Size(500)
.Sort(__ => __.Field(t => t.Timestamp, SortOrder.Descending))
.Query(
q =>
q.Bool(b=>
b.Must(
bs=>bs.Term(m => m.Field(f => f.EntityId).Value(entityId)),
bs=>bs.Match(m=> m.Field(f=> f.AuditHistoryEnum).Query(auditHistoryEnum.ToString())) || bs.Match(m => m.Field(f => f.AuditHistoryEnum).Query(null))
))
)
);
Using query above, I get all the new documents where AuditHistoryEnum is a field in the stored documents. The documents stored before the addition can no be retrieved using query above. What am I doing wrong?
BR, Anders