Create a query with OR condition in elasticsearch 5.4

Elastic Stack Elasticsearch
1

I am creating a query to search a particular text in 3 different fields in my indexed data.
ie I want a query like

where  sender='%abc%' OR recipient ="%abc%" OR bcc = "%abc%"

I tried to create the query which returns a resultset, but I havn't given an OR condition anywhere.
Couldn't find "default_operator": "OR"

{
 "query": {
   "bool": {
      "must": [
         {"multi_match": {
             "fields": [
                "sender",
                "bcC",
                "recipient "
             ],
            "query": "abc"               
         }
         
         }
      ]         
   } 
}
}
3

The field is called 'operator' when using multi_match

https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-multi-match-query.html#operator-min

"multi_match": {
"fields": [
"sender",
"bcc",
"recipient"
],
"operator": "and"
}

Make sure you read the documentation and the alternatives to using the
'and' operator.

4

where sender='%abc%' OR recipient ="%abc%" OR bcc = "%abc%"

this query correspond to something like that

{
  "query": {
    "bool": {
      "should": [
        {
          "wildcard": {
            "sender": {
              "value": "*abc*"
            }
          }
        },
        {
          "wildcard": {
            "recipient": {
              "value": "*abc*"
            }
          }
        },
        {
          "wildcard": {
            "bbc": {
              "value": "*abc*"
            }
          }
        }
      ]
    }
  }
}

or if you want with match queries

{
  "query": {
    "bool": {
      "should": [
        {
          "match": {
            "sender": "abc"
          }
        },
        {
          "match": {
            "recipient": "abc"
          }
        },
        {
          "match": {
            "bbc": "abc"
          }
        }
      ]
    }
  }
}
5

Thank you very much. The 1st example gave me the what I expected.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.