Composite Filter and or Quarry?

Elastic Stack Elasticsearch
1

Hello is there a way to filter out results in a composite search?

is there a way to set up a filter and or could I use a quarry?

if so how would that look in the DSL search language?

2

Hi @iukea,

you can use the bool query to create composite queries, for instance:

GET test/_search
{
  "query" : {
    "bool" : {
      "filter": [
	{"range": {"timestamp1": {"gte": "now-1w"}}},
	{"range": {"timestamp2": {"gte": "now-2d"}}}
      ]
    }
  }
}
1 Like
3

Thank you!

would there be a way to do a composite search that grabs all the src_ips from my NGIX logs and filter out the Src_IPs from my Apache logs?

Those logs are in the same index, but there I tell them apart by

type : Apache
   - Src_ip

and

 type: NGIX  
     -Src_ip
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.