And/OR DSL Query

Elastic Stack Elasticsearch
1

Hello,

I'm having a difficult time getting a DSL query to work right with a combination of an AND and OR.

For the OR side, one of the two must be present in the document....

{ "state": "active" }
{ "state": "re-surfaced" }

And all documents must be present in the following date range.....

"range":
{
"last_assessed_for_vulnerabilities": {
"gte": "now-75d/d",
"lte": "now-45d/d"
}

So logic is as follows:

(state=active or state=re-surfaced) and (range)

I have this so far, but I'm running into syntax issues.

  "query": 
  {
    "bool": 
    {
      "must": 
      [ 
        {
          "bool": 
          {
            "should": 
            [
              { "match": { "state": "active" } },
              { "match": { "state": "re-surfaced" } }
            ]
          },
           "range": 
           {
             "last_assessed_for_vulnerabilities": {
               "gte": "now-75d/d",
               "lte": "now-45d/d"
             }
           }
        }
      ]  
    }
  }
}

Any help would be appreciated!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.