How to query elasticsearch for records where 'value==1 or value not recorded'?

Viewed 26

TLDR -- how to query elasticsearch for records where 'value==1 or value not recorded'?

We use Elasticsearch for audit trails in a relatively new system. The auditing initially only applied to a single entity.

It was saved in Elasticsearch by creating a message, converting to json and storing. This was old record:

public class AuditMessage
{
    public int EntityId { get; set; }
}

Now we wish to record audit trail for the next entity and we add enum to distinquish:

public class AuditMessage
{
    public AuditHistoryEnum AuditHistoryEnum { get; set; }
    public int EntityId { get; set; }
}

Finally we query like this:

                var response = await _elasticClient.SearchAsync<AuditMessage>(_ => _
                .Index(indices)
                .From(0)
                .Size(500)
                .Sort(__ => __.Field(t => t.Timestamp, SortOrder.Descending))
                .Query(
                    q =>
                        q.Bool(b=>
                            b.Must(
                                bs=>bs.Term(m => m.Field(f => f.EntityId).Value(entityId)),
                                bs=>bs.Match(m=> m.Field(f=> f.AuditHistoryEnum).Query(auditHistoryEnum.ToString())) || bs.Match(m => m.Field(f => f.AuditHistoryEnum).Query(null))
                                ))
                        
                )
            );

Using query above, I get all the new documents where AuditHistoryEnum is a field in the stored documents. The documents stored before the addition can no be retrieved using query above. What am I doing wrong?

BR, Anders

1 Answers

Try something like this:

var response = await _elasticClient.SearchAsync<AuditMessage>(_ => _
    .Index(indices)
    .From(0)
    .Size(500)
    .Sort(__ => __.Field(t => t.Timestamp, SortOrder.Descending))
    .Query(q => q.Terms(t => t.Field(f => f.AuditHistoryEnum).Terms(auditHistoryEnum.ToString()))
        || !q.Exists(e => e.Field(f => f.AuditHistoryEnum))));
Related