如何在Elasticsearch正则表达式中排除子字符串

Let me break this down for you—your issue is that the @&~(foo.+) syntax from the docs is just a conceptual example, not actual Elasticsearch query code. You can't directly stick that negation into a regexp filter. Instead, we need to use Elasticsearch's native boolean query logic to exclude matching documents.

Here's the Corrected Approach #

Your existing query structure uses a constant_score filter with a bool query. To exclude books where the title contains a specific substring (like "foo"), we'll add a must_not clause to that bool query—this is Elasticsearch's way of saying "exclude any docs that match this condition".

Full Query Example (JSON)

{
  "query": {
    "constant_score": {
      "filter": {
        "bool": {
          "filter": [
            // Add your existing filters here (e.g., category: books)
            { "term": { "category": "books" } }
          ],
          "must_not": [
            // Exclude titles containing "foo"
            { "regexp": { "title.keyword": ".*foo.*" } }
          ]
        }
      }
    }
  },
  "size": 1000
}

Translated to Your Ruby Code

Since you're using Ruby to build the query, here's how to adjust your query_filters and surrounding structure:

def query_filters
  [
    # Your existing filter conditions go here
    { term: { category: "books" } }
  ]
end

# Final query hash
{
  query: {
    constant_score: {
      filter: {
        bool: {
          filter: query_filters,
          must_not: [
            # Exclude titles with "foo" (use title.keyword for exact string matching)
            { regexp: { "title.keyword": ".*foo.*" } }
            # If you need to exclude titles STARTING with "foo", use "foo.*" instead
          ]
        }
      }
    }
  },
  size: 1_000
}

Key Notes to Avoid Headaches #

1. Use the Keyword Subfield: If your title field is mapped as a text type (the default), always use title.keyword for regex matching. The text field is tokenized, so regex would match individual words instead of the full title string.
2. Prefer match Over Regex When Possible: If you're just excluding a fixed substring like "foo", a match query in must_not is way faster than regex (it uses Elasticsearch's inverted index):

   must_not: [ { match: { title: "foo" } } ]
   

3. Regex Syntax Rules: Elasticsearch uses Lucene's regex syntax—so no fancy negation operators inside the regex itself. All exclusion logic lives in the bool query's must_not clause.

内容的提问来源于stack exchange，提问作者abaldwinhunter