elasticsearch bool query combine must with OR

by
  • OR is spelled should
  • AND is spelled must
  • NOR is spelled should_not

Example:

You want to see all the items that are (round AND (red OR blue)):

    {
        "query": {
            "bool": {
                "must": [
                    {
                        "term": {"shape": "round"}
                    },
                    {
                        "bool": {
                            "should": [
                                {"term": {"color": "red"}},
                                {"term": {"color": "blue"}
                            ]
                        }
                    }
                ]
            }
        }
    }

You can also do more complex versions of OR, for example if you want to match at least 3 out of 5, you can specify 5 options under “should” and set a “minimum_should” of 3.

Thanks to Glen Thompson and Sebastialonso for finding where my nesting wasn’t quite right before.

Thanks also to Fatmajk for pointing out that “term” becomes “match” in ElasticSearch 6.

More Related Contents:

  1. Elasticsearch replication of other system data?
  2. Shards and replicas in Elasticsearch
  3. ElasticSearch – Return Unique Values
  4. Elasticsearch: Failed to connect to localhost port 9200 – Connection refused
  5. Calculating time between events
  6. Aggregation + sorting +pagination in elastic search
  7. Elasticsearch: Difference between “Term”, “Match Phrase”, and “Query String”
  8. Join query in ElasticSearch
  9. UTF8 encoding is longer than the max length 32766
  10. Queries vs. Filters
  11. Change default mapping of string to “not analyzed” in Elasticsearch
  12. Find distinct values, not distinct counts in elasticsearch
  13. elasticsearch match vs term query
  14. Elasticsearch vs Cassandra vs Elasticsearch with Cassandra
  15. Elasticsearch difference between MUST and SHOULD bool query
  16. How to change Elasticsearch max memory size
  17. Find documents with empty string value on elasticsearch
  18. How to get latest values for each group with an Elasticsearch query?
  19. What is the maximum Elasticsearch document size?
  20. How to create unique constraint in Elasticsearch database?
  21. How to iterate through a nested array in elasticsearch with filter script?
  22. elasticsearch – querying multiple indexes is possible?
  23. ElasticSearch – Get only matching nested objects with All Top level fields in search response
  24. Elasticsearch – set max_clause_count
  25. ElasticSearch: aggregation on _score field?
  26. How to parse json in logstash /grok from a text file line?
  27. Logstash: Merge two logs into one output document
  28. Elasticsearch error: cluster_block_exception [FORBIDDEN/12/index read-only / allow delete (api)], flood stage disk watermark exceeded
  29. What is the ElasticSearch equivalent for an SQL subquery?
  30. How to create multiple indexes in logstash.conf file?

Leave a Comment