AND between must and should

[Fabio_Batalha]

Hello,

I would like to know how to put an AND operator between a MUST and SHOULD.

As for example. In the query bellow I want to have all the documents with the given IP addresses and at least one of the timestamp ranges in the SHOULD.

At this moment, if none of the ranges in SHOULD are valid, the records of the MUST queries are being still retrieved.

GET /site_usage/usage_events/_search
{
"query": {
"bool": {
"must": [
{"terms": {"geoip.ip": ["136.187.96.170", "136.187.96.171"]}}
],
"should": [
{"range": {"timestamp": {"gte": "2019-01-15", "lte": "2019-01-17", "format": "yyyy-MM-dd"}}},
{"range": {"timestamp": {"gte": "2019-01-22", "lte": "2019-01-23", "format": "yyyy-MM-dd"}}}
]
}
},
"size": 0
}

Thanks in advance.

[RahulD (Rahul Desai)]

you can do something like:

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "must": [
              {
                #query from original must block
              }
            ]
          }
        },
        {
          "bool": {
            "should": [
              {
                #query from original should block
              }
            ]
          }
        }
      ]
    }
  }
}