Bool search with MUST for nested, nested string

Here is a example of what I am trying to run, the last query is the one in question

GET sev_incidents/_search
{
    "query": {
      "bool": {
        "must": [
          {
            "query_string": {
              "query": "** AND open:false",
              "fields": [
                "number"
              ]
            }
          },
          {
            "query_string": {
              "query": "*Amazon*",
              "fields": [
                "company"
              ]
            }
          },
          {
            "nested": {
              "path": "update.sites",
              "query": {
                "query_string": {
                  "query": "\"ALBANY,GA\" AND \"AFNI (Bloomington IL)\"",
                  "fields": [
                    "update.sites.name"
                  ]
                }
              }
            }
          }
        ]
      }
    }
}

With the addition of the third query, this search fails. The data structure for update.sites is:

 [
                {
                  "name": "ALBUQUERQUE",
                  "sys_id": "d6c04e140f92b500d55ae498b1050e25"
                }
 ]

We need to be able to search for multiple sites that all "must" be part of the search. Any help would this would be much appreciated.

Thank you,
Ryan

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.