How do I combine multiple queries in ElasticSearch

Question

For reference here is the code. I am trying to make a hubot plugin that logs to elasticsearch and then uses hubot commands to search those logs.

https://gist.github.com/4050748

I am trying to retrieve records that match two queries.

{ 
  query: { 
        match: {
          user: "SomeUsername" 
        }, 
        range: {
          date: {
            from: (Date.now() - 3600) 
          }
        }
  },
  size: 50 
}

I was expecting:

Up to 50 records
records that had the given user
records in the last hour

I got:

up to 10 records
records that had the given user
from any time

How do I get all the records with some username in the last hour? Do I need to use match_all with filters? Is what I am attempting unsupported?

In SQL it would be something like:

Select (*) from messages where user_name = ? and time > ?

Cody A. Ray · Accepted Answer · 2015-01-12 17:26:13Z

23

For anyone who stumbles on this question and wonders what it looks like to combine a match and range query in ElasticSearch, this example would look like

curl 'localhost:9200/<index>/_search?pretty=true' -d '{
  "query" : {
    "bool": {
      "must": [
        {
          "match": {
            "user": "SomeUsername"
          }
        },
        {
          "range" : {
            "date": {
              "gt": "now-1h"
            }
          }
        }
      ]
    }
  }
}'

answered Jan 12, 2015 at 17:26

Cody A. Ray

6,0671 gold badge40 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Evaldas Raisutis Over a year ago

Are the queries run in the order they are specified? As in, range query will be applied on users found by the first one?

Cody A. Ray Over a year ago

@EvaldasRaisutis I would assume so based on the choice of the API to use a list in "match" but I don't know for sure.

javanna · Accepted Answer · 2012-11-13 08:51:31Z

18

You need to use the bool query to combine different queries together. You can then choose whether each single query must match, should match (optional), or must not match.

answered Nov 13, 2012 at 8:51

javanna

60.4k14 gold badges147 silver badges125 bronze badges

1 Comment

Azhar Uddin Sheikh Over a year ago

elastic.co/guide/en/elasticsearch/reference/current/…

Collectives™ on Stack Overflow

How do I combine multiple queries in ElasticSearch

2 Answers 2

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related