# Filtering based on values in multiple nested documents **URL:** \ **Category:** Elasticsearch\ **Created:** [July 22, 2013, 6:29pm UTC](https://discuss.elastic.co/t/filtering-based-on-values-in-multiple-nested-documents/12883 "2013-07-22T18:29:07Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ryan\_2](https://avatars.discourse-cdn.com/v4/letter/r/6bbea6/32.png) [@ryan\_2](https://discuss.elastic.co/u/ryan_2)\ **Post date:** [July 22, 2013, 6:29pm UTC](https://discuss.elastic.co/t/filtering-based-on-values-in-multiple-nested-documents/12883/1 "2013-07-22T18:29:07Z")
We are having a beast of a time trying to figure this one out. We have a document structure where we are using nested "keywords" documents to model arbitrary metadata in what I guess would be called an overnormalized schema... { "keywords": [ {"field": "foo", "value": "abc"}, {"field": "bar", "value": "def"} ] } I'm looking for a query that will return the above document via the logic expressed in the following pseudo-query: return all documents that contain 2 keywords children WHERE one of them has (keywords.field "foo" with value "abc") AND the other one has (keywords.field "bar" with value "def"). I'm hoping I'm missing something fundamental and simple (would a "must" query somehow help?), but it appears this is not very easy to accomplish. This is the closest we can get with our burgeoning understanding of ES queries (coming from vanilla Lucene background)... { "query": { "filtered": { "query": { "match\_all": {}}, "filter": { "and": [ { "nested": { "path": "keywords", "query": { "query\_string": "keywords.field:foo AND keywords.value:abc" } } }, { "nested": { "path": "keywords", "query": { "query\_string": "keywords.field:bar AND keywords.value:def" } } } ] } } } } Removing one or the other of the nested queries does, of course, return the document, but using them both results in 0 documents where I expect 1. I can almost see why the above query won't work, but what I can't see if the way to change it into something that will work. Any help is very much appreciated. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![ryan\_2](https://avatars.discourse-cdn.com/v4/letter/r/6bbea6/32.png) [@ryan\_2](https://discuss.elastic.co/u/ryan_2)\ **Post date:** [July 22, 2013, 7:41pm UTC](https://discuss.elastic.co/t/filtering-based-on-values-in-multiple-nested-documents/12883/2 "2013-07-22T19:41:44Z")
OK, so, nevermind... it's funny because we had been messing around with this for a good day or two and it appears my breaking it down into simplified terms for this post has uncovered our issues. Our actual attempts were slightly different from what I posted here (the "nested" declaration was made at a higher level and only once). It seems the answer was just making sure the nested/path declaration is made in each of the "and" queries. On Monday, July 22, 2013 1:29:07 PM UTC-5, [ry...@huterra.com](mailto:ry...@huterra.com) wrote: > We are having a beast of a time trying to figure this one out. > > We have a document structure where we are using nested "keywords" > documents to model arbitrary metadata in what I guess would be called an > overnormalized schema... > > { > "keywords": [ > {"field": "foo", "value": "abc"}, > {"field": "bar", "value": "def"} > ] > } > > I'm looking for a query that will return the above document via the logic > expressed in the following pseudo-query: return all documents that contain > 2 keywords children WHERE one of them has (keywords.field "foo" with value > "abc") AND the other one has (keywords.field "bar" with value "def"). > > I'm hoping I'm missing something fundamental and simple (would a "must" > query somehow help?), but it appears this is not very easy to accomplish. > > This is the closest we can get with our burgeoning understanding of ES > queries (coming from vanilla Lucene background)... > > { > "query": { > "filtered": { > "query": { "match\_all": {}}, > "filter": { > "and": [ > { > "nested": { > "path": "keywords", > "query": { > "query\_string": "keywords.field:foo AND > keywords.value:abc" > } > } > }, > { > "nested": { > "path": "keywords", > "query": { > "query\_string": "keywords.field:bar AND > keywords.value:def" > } > } > } > ] > } > } > } > } > > Removing one or the other of the nested queries does, of course, return > the document, but using them both results in 0 documents where I expect 1. > > I can almost see why the above query won't work, but what I can't see if > the way to change it into something that will work. Any help is very much > appreciated. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:25am UTC](https://discuss.elastic.co/t/filtering-based-on-values-in-multiple-nested-documents/12883/3 "2017-07-06T02:25:07Z")