'must_not cluase is not working in elastic

I have documents in elastic with following format, where trunk value can be one of [1PCX05, 2PCX05, 3PCX05 6PCX05]

 "doc": {
      "keys": {
        "trunk": "6PCX05",
        "direction": "incoming",
        "country": "CHN",
        "service": "ENTVTS",
        "company": "XYZ"
      }
}

But when I am running following query to filter documents on filtering company field and must_not -> terms with specific trunks but must_not cluase is not getting applied and i am getting all documents with company name "XYZ"

POST /my_index-*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "match": {
            "doc.keys.company": {
              "query": "XYZ",
              "operator": "OR",
              "prefix_length": 0,
              "max_expansions": 50,
              "fuzzy_transpositions": true,
              "lenient": false,
              "zero_terms_query": "NONE",
              "auto_generate_synonyms_phrase_query": true,
              "boost": 1
            }
          }
        }
      ],
      "must_not": [
        {
          "terms": {
            "doc.keys.trunk": [
              "3PCX05,2PCX05,1PCX05"
            ],
            "boost": 1
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  }
}

I also tried using keyword in doc.keys.trunk.keyword, but still not working



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source