Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The _missing_ query does not work #4362

Closed
onyxmaster opened this issue Nov 20, 2017 · 3 comments
Closed

The _missing_ query does not work #4362

onyxmaster opened this issue Nov 20, 2017 · 3 comments

Comments

@onyxmaster
Copy link

@onyxmaster onyxmaster commented Nov 20, 2017

Expected Behavior

When the _missing_ query is used, it should return the messages that do not have the specified field.

Current Behavior

Any _missing_ query does not return any messages.

Steps to Reproduce (for bugs)

Try searching for messages with _missing_:non_existent_field query -- you will get none.

Context

Surprisingly, NOT _exists_:... works.

  • Graylog Version: 2.3.2+3df951e
  • Elasticsearch Version: 5.6.3
  • MongoDB Version: 3.4.7
  • Operating System: Irrelevant
  • Browser version: Irrelevant
@jsleeio
Copy link

@jsleeio jsleeio commented Dec 15, 2017

We're experiencing the same behaviour — _missing_:foo not working, NOT _exists_:foo working

Graylog v2.3.2 and v2.4.0-beta
Elasticsearch v5.4.2

@joschi
Copy link
Contributor

@joschi joschi commented Dec 15, 2017

@onyxmaster @indigoid The _missing_ query has been removed in Elasticsearch 5.0:
https://www.elastic.co/guide/en/elasticsearch/reference/5.6/breaking_50_search_changes.html#_deprecated_queries_removed

Either downgrade to Elasticsearch 2.x (don't do that…) or use the negated _exists_ query.

@joschi joschi closed this Dec 15, 2017
joschi pushed a commit that referenced this issue Dec 15, 2017
Jochen Schalanda
@onyxmaster
Copy link
Author

@onyxmaster onyxmaster commented Dec 15, 2017

Thanks for the info. I believe the http://docs.graylog.org/en/2.3/pages/queries.html#syntax should be updated also.

joschi pushed a commit to Graylog2/documentation that referenced this issue Dec 15, 2017
Jochen Schalanda
joschi pushed a commit to Graylog2/documentation that referenced this issue Dec 15, 2017
Jochen Schalanda
edmundoa added a commit that referenced this issue Dec 15, 2017
joschi added a commit that referenced this issue Dec 15, 2017
The "_missing_" query has been removed in Elasticsearch 5.0:

https://www.elastic.co/guide/en/elasticsearch/reference/5.0/breaking_50_search_changes.html#_deprecated_queries_removed

Refs #4362

(cherry picked from commit 5142243)
jalogisch added a commit to Graylog2/documentation that referenced this issue Dec 15, 2017
joschi added a commit to Graylog2/documentation that referenced this issue Dec 15, 2017
Refs Graylog2/graylog2-server#4362

(cherry picked from commit 61192cf)
joschi added a commit to Graylog2/documentation that referenced this issue Dec 15, 2017
Refs Graylog2/graylog2-server#4362

(cherry picked from commit 61192cf)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants