AND between must and should

Elastic Stack Elasticsearch
1

Hello,

I would like to know how to put an AND operator between a MUST and SHOULD.

As for example. In the query bellow I want to have all the documents with the given IP addresses and at least one of the timestamp ranges in the SHOULD.

At this moment, if none of the ranges in SHOULD are valid, the records of the MUST queries are being still retrieved.

GET /site_usage/usage_events/_search
{
"query": {
"bool": {
"must": [
{"terms": {"geoip.ip": ["136.187.96.170", "136.187.96.171"]}}
],
"should": [
{"range": {"timestamp": {"gte": "2019-01-15", "lte": "2019-01-17", "format": "yyyy-MM-dd"}}},
{"range": {"timestamp": {"gte": "2019-01-22", "lte": "2019-01-23", "format": "yyyy-MM-dd"}}}
]
}
},
"size": 0
}

Thanks in advance.

2

you can do something like:

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "must": [
              {
                #query from original must block
              }
            ]
          }
        },
        {
          "bool": {
            "should": [
              {
                #query from original should block
              }
            ]
          }
        }
      ]
    }
  }
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.