ElasticSearch Multiple condition in search query

Question

I have a requirement to build a search query with the following set of rules.

Get all the data which has the column / node active=true
Get all the data which has the column / node active=false and also which is one week old.

For instance if i have a 1000 records in a index in which there are 70% of the records having active=true and 30% of the records having active=false. Out of 30% of the records 10% is updated recently. So i need to fetch only the 80% of the records i.e 70% (active=true) + 10% (active=false).

I have tried with filter query but it's returning only the 10% of the result i.e satisfying only the Rule 2 even though i have mentioned the Rule 1 in the should block it's not accepting.

   {
  "query": {
    "bool": {
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "UpdatedOn": {
                  "gte": "now-7d/d",
                  "lte": "now/d"
                }
              }
            },
            {
              "match": {
                "Active": "false"
              }
            }
          ]
        }
      },
      "should": [
        {
          "match": {
            "Active": "true"
          }
        }
      ]
    }
  }
}

ElasticSearch Version 5.4

Thanks in advance.

Val · Accepted Answer · 2018-06-21 13:44:53Z

2

You need to do it like this:

{
  "query": {
    "bool": {
      "minimum_should_match": 1,
      "should": [
        {
          "match": {
            "Active": "true"
          }
        },
        {
          "bool": {
            "filter": [
              {
                "range": {
                  "UpdatedOn": {
                    "gte": "now-7d/d",
                    "lte": "now/d"
                  }
                }
              },
              {
                "match": {
                  "Active": "false"
                }
              }
            ]
          }
        }
      ]
    }
  }
}

answered Jun 21, 2018 at 13:44

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

Vijayakumar Over a year ago

A quick question. I have removed the "minimum_should_match": 1 and i'm getting the same set of results. Do we really need this... ?

Val Over a year ago

No you can remove it, I added it first because you were using must, but then I changed to filter (since no ranking is involved), hence you can remove the clause

Vijayakumar Over a year ago

i have checked the above query.It's not satisfying the condition. It's returning the results which is two weeks old.

Val Over a year ago

Then you need to revise your conditions in your question ;-)

Val Over a year ago

Condition 1 doesn't set any constraints on the time, so that's probably why you're receiving documents that are 2 weeks old. Which are the real conditions you want?

|

Collectives™ on Stack Overflow

ElasticSearch Multiple condition in search query

1 Answer 1

9 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

9 Comments

Your Answer

Sign up or log in

Post as a guest

Related