Complex query in Kibana

This is a bit complicated, but I think it's a clue to what you're trying to do. You could used the Advanced JSON Input field.