Easy question for you experts - need help with a query

I’m trying to do a search on multiple fields in collection. This is what I tried. How do I fix this?

search_query = {

    "query": {

        "match": {

            "RunID": RunID,

            "host": host_name

        }

    }

}

Hey there @HaroldMelamed and welcome to the community! You may want to check out our multi-match query, that should get you what you want for the same search string. Or a boolean query for multiple terms. Happy searching!

what I’m looking for is to search two different fields in a single query with different search criteria. For example

(runID = 12324 and host = LRE)

Hi @HaroldMelamed

@Kathleen_DeRusso gave you the correct answer using a bool

{
  "query": {
    "bool" : {
      "must" : {
        "term" : { "runID" : "12324" },
         "term" : { "host" : "LRE" }

      },
.... 

Thank you very much the exact query. I need even the most basic help these days. At my age it appears that my brain is full . :grinning_face:

All good ... Many of the free LLMs are a great place to start with helping to write queries.

here at the bank we aren’t doing AI yet. They promised soon. Thanks for the idea!!

@stephenb

The code works but VSCODE isn’t appreciative of the code.

search_query = {

    "query": {

        "bool": {

            "must": {

                "term": {"runID": RunID},

                "term": {"host": host_name}



            }

        }

    }

}

image

If you look at the API docs for the bool query linked above, I think you’re missing some { } to denote objects in json for each term query.

Working Example ... sorry I wrote that first one on my phone
You need the array bracket [ ]

If you Go into Kibana Dev Tools, the Smart Editor will help with all that..
If you are trying to write DSL outside of that, you will likely make many mistakes :slight_smile:

POST my_index/_doc
{
  "foo" : "fooish",
  "bar" : "barish"

}

POST my_index/_doc
{
  "foo" : "fooish",
  "bar" : "notbarish"

}

GET my_index/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "foo": "fooish"
          }
        },
        {
          "term": {
            "bar": "barish"
          }
        }
      ]
    }
  }
}