Exists query in Elasticsearch - Step-by-Step Execution

Concept Flow - Exists query

Start

↓

Send Exists Query

↓

Check if field exists in documents

↓

Return matching documents

↓

Return no matches

↓

End

The Exists query checks if a specific field is present in documents and returns those documents that have the field.

Execution Sample

Elasticsearch

{
  "query": {
    "exists": {
      "field": "user"
    }
  }
}

This query finds all documents where the 'user' field exists.

Execution Table

Step	Action	Field Checked	Document Field Present?	Result
1	Send query to Elasticsearch	user	N/A	Query received
2	Check document 1	user	Yes	Document 1 matches
3	Check document 2	user	No	Document 2 does not match
4	Check document 3	user	Yes	Document 3 matches
5	Return all matching documents	user	N/A	Documents 1 and 3 returned

💡 All documents checked; only those with 'user' field are returned

Variable Tracker

Variable	Start	After Doc 1	After Doc 2	After Doc 3	Final
matched_documents	[]	[Doc1]	[Doc1]	[Doc1, Doc3]	[Doc1, Doc3]

Key Moments - 2 Insights

Why does the query only return documents that have the 'user' field?

Because the Exists query specifically checks if the 'user' field is present in each document, as shown in execution_table rows 2-4. Documents without the field are excluded.

What happens if no documents have the 'user' field?

The query returns no matches, as the check in execution_table would always be 'No', resulting in an empty matched_documents list.

Visual Quiz - 3 Questions

Look at the execution_table, which documents matched the query?

A Documents 2 and 3

B Documents 1 and 3

C Only Document 2

D All documents

💡 Hint

Check the 'Result' column in rows 2-4 of the execution_table.

At which step does the query decide a document does not match?

A Step 1

B Step 2

C Step 3

D Step 5

💡 Hint

Look at the 'Result' column in execution_table row 3.

If the field checked was changed to 'email', how would the matched_documents variable change?

A It would include documents with the 'email' field instead

B It would remain the same

C It would include all documents

D It would be empty regardless

💡 Hint

Refer to variable_tracker and understand it tracks documents matching the field checked.

Concept Snapshot

Exists query syntax:
{
  "query": {
    "exists": { "field": "fieldname" }
  }
}

Returns documents where the specified field exists.
Useful to filter documents that have a particular field.
Does not match documents missing that field.

Full Transcript

The Exists query in Elasticsearch checks if a specific field is present in documents. When you send this query, Elasticsearch looks at each document to see if the field exists. If it does, that document is included in the results. If not, it is skipped. For example, checking for the 'user' field returns only documents that have 'user'. This is useful to find documents containing certain information. The execution table shows each step: sending the query, checking documents, and returning matches. The variable tracker shows how matched documents build up as documents are checked. Common confusions include why only some documents return and what happens if no documents have the field. The quiz tests understanding of which documents match and how changing the field affects results.

Practice

1. What does the exists query do in Elasticsearch?

easy

A. Finds documents where a specific field is present

B. Finds documents where a field has a specific value

C. Deletes documents missing a field

D. Updates documents with a missing field

Solution

1. Step 1: Understand the purpose of the exists query

   The exists query checks if a field exists in documents, filtering those that have the field.

2. Step 2: Compare options with the query's function

   Only Finds documents where a specific field is present correctly describes this behavior; others describe different operations.

3. Final Answer:

   Finds documents where a specific field is present -> Option A

4. Quick Check:

   Exists query = finds documents with field [OK]

Hint: Exists query checks if a field is present in documents [OK]

Common Mistakes:

• Confusing exists query with term query
• Thinking it deletes or updates documents
• Assuming it checks field values

2. Which of the following is the correct syntax for an exists query in Elasticsearch?

easy

A. {"query": {"exists": {"field_name": "user"}}}

B. {"query": {"exists": "user"}}

C. {"query": {"exists": {"value": "user"}}}

D. {"query": {"exists": {"field": "user"}}}

Solution

1. Step 1: Recall the correct JSON structure for exists query

   The exists query requires a "field" key inside its object specifying the field name.

2. Step 2: Match options to correct syntax

   {"query": {"exists": {"field": "user"}}} matches the correct syntax: {"exists": {"field": "user"}}. Others use wrong keys or structure.

3. Final Answer:

   {"query": {"exists": {"field": "user"}}} -> Option D

4. Quick Check:

   Exists query syntax uses "field" key [OK]

Hint: Exists query needs "field" key inside its object [OK]

Common Mistakes:

• Using "value" or "field_name" instead of "field"
• Omitting the object braces around field
• Passing field as a string directly

3. Given the following Elasticsearch query, what documents will it return?

{"query": {"exists": {"field": "email"}}}

medium

A. Documents where the email field exists

B. Documents where the email field is missing

C. Documents where the email field is empty

D. All documents regardless of email field

Solution

1. Step 1: Analyze the query structure

   The query uses an exists query on the field "email", which filters documents having that field.

2. Step 2: Understand what exists means for documents

   Documents returned must have the "email" field present, regardless of its value.

3. Final Answer:

   Documents where the email field exists -> Option A

4. Quick Check:

   Exists query returns docs with field present [OK]

Hint: Exists query returns docs with the field present only [OK]

Common Mistakes:

• Thinking it returns docs missing the field
• Assuming empty fields are excluded
• Believing it returns all documents

4. Identify the error in this Elasticsearch exists query:

{"query": {"exists": {"field_name": "status"}}}

medium

A. The field value should be an array, not a string

B. The query should use "match" instead of "exists"

C. The key should be "field", not "field_name"

D. The query is missing a "filter" wrapper

Solution

1. Step 1: Check the key used inside exists query

   The exists query requires the key "field" to specify the field name.

2. Step 2: Compare the given key with the correct one

   The query uses "field_name" which is incorrect and causes an error.

3. Final Answer:

   The key should be "field", not "field_name" -> Option C

4. Quick Check:

   Exists query key = "field" [OK]

Hint: Use "field" key inside exists query, not "field_name" [OK]

Common Mistakes:

• Using incorrect key names inside exists query
• Confusing exists with match query
• Adding unnecessary wrappers

5. You want to find all documents where the field phone exists but is not empty or null. Which Elasticsearch query best achieves this?

hard

A. {"query": {"bool": {"must": [{"exists": {"field": "phone"}}, {"term": {"phone": ""}}]}}}

B. {"query": {"bool": {"must": [{"exists": {"field": "phone"}}, {"script": {"script": "doc['phone'].value != ''"}}]}}}

C. {"query": {"exists": {"field": "phone"}}}

D. {"query": {"exists": {"field": "phone"}, "term": {"phone": ""}}}

Solution

1. Step 1: Understand the requirement

   We want documents where "phone" exists and is not empty or null.

2. Step 2: Evaluate each option

   {"query": {"exists": {"field": "phone"}}} only checks existence, not emptiness. {"query": {"bool": {"must": [{"exists": {"field": "phone"}}, {"term": {"phone": ""}}]}}} incorrectly requires phone to be empty. {"query": {"exists": {"field": "phone"}, "term": {"phone": ""}}} has invalid syntax combining exists and term at same level. {"query": {"bool": {"must": [{"exists": {"field": "phone"}}, {"script": {"script": "doc['phone'].value != ''"}}]}}} uses a bool must with exists and a script checking phone is not empty, correctly filtering as needed.

3. Final Answer:

   {"query": {"bool": {"must": [{"exists": {"field": "phone"}}, {"script": {"script": "doc['phone'].value != ''"}}]}}} -> Option B

4. Quick Check:

   Exists + script to exclude empty = {"query": {"bool": {"must": [{"exists": {"field": "phone"}}, {"script": {"script": "doc['phone'].value != ''"}}]}}} [OK]

Hint: Combine exists with script to exclude empty values [OK]

Common Mistakes:

• Using exists alone without checking empty values
• Incorrectly combining queries at same level
• Assuming term query with empty string works for exclusion