# Help me rewrite my elasticsearch query

**URL:** <https://discuss.elastic.co/t/help-me-rewrite-my-elasticsearch-query/43657>\
**Category:** Elasticsearch\
**Created:** [March 7, 2016, 1:19pm UTC](https://discuss.elastic.co/t/help-me-rewrite-my-elasticsearch-query/43657 "2016-03-07T13:19:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yodog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yodog/32/4822_2.png) [@yodog](https://discuss.elastic.co/u/yodog)\
**Post date:** [March 7, 2016, 1:19pm UTC](https://discuss.elastic.co/t/help-me-rewrite-my-elasticsearch-query/43657/1 "2016-03-07T13:19:52Z")

</div>

I need some help rewriting my elasticsearch query.

What i need is:

1- to show a single record if there is an exact match on the two fields `verb` and `sessionid.raw` (partial matches are not accepted).

```
"must": [
    { "match" : { "verb" : "login" } },
    { "term" : { "sessionid.raw" : strSessionID } },
]

```

OR

2- to show the top 5 records (sorted by `_score DESC` and `@timestamp ASC`) that match some other fields, giving a boost if the records are between the specified time range.

```
"must": [
    { "match" : { "verb" : "login" } },
    { "term" : { "pid" : strPID } },
],
"should": [
    { "match" : { "user.raw" : strUser } },
    { "range" : { "@timestamp" : {
        "from" : QueryFrom,
        "to" : QueryTo,
        "format" : DateFormatElastic,
        "time_zone" : "America/Sao_Paulo",
        "boost" : 2 }
    } },
]

```

The code below is almost doing what i want.  
Right now it boosts `sessionid.raw` to the top if found, but the remaining records are not being discarded.

```
var objQueryy = {
    "fields" : ["@timestamp", "program", "pid", "sessionid.raw", "user", "frontendip", "frontendname", "_score"],
    "size" : ItemsPerPage,
    "sort" : [{ "_score" : { "order": "desc" } }, { "@timestamp" : { "order" : "asc" } }],
    "query" : {
        "bool": {
            "must": [
                { "match" : { "verb" : "login" } },
                { "term" : { "pid" : strPID } },
                { "bool": {
                    "should": [
                        { "match" : { "user.raw" : strUser } },
                        { "match" : { "sessionid.raw": { "query": strSessionID, "boost" : 3 } } },
                        { "range" : { "@timestamp" : { "from": QueryFrom, "to": QueryTo, "format": DateFormatElastic, "time_zone": "America/Sao_Paulo" } } },
                    ],
                }},
            ],
        },
    },
}
```

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [March 8, 2016, 10:15am UTC](https://discuss.elastic.co/t/help-me-rewrite-my-elasticsearch-query/43657/2 "2016-03-08T10:15:28Z")

</div>

The easiest way to do this would be to run 2 search requests: a first one for the exact match, and then the other one if the first one did not yield any results.

---

<div class="post-metadata">

**Author:** ![yodog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yodog/32/4822_2.png) [@yodog](https://discuss.elastic.co/u/yodog)\
**Post date:** [March 8, 2016, 11:43am UTC](https://discuss.elastic.co/t/help-me-rewrite-my-elasticsearch-query/43657/3 "2016-03-08T11:43:10Z")

</div>

Thanks.

And about the hard way...

Is it possible to do it with only one query, and im just missing the logic behind it?

Or its not possible at all?

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [March 8, 2016, 1:20pm UTC](https://discuss.elastic.co/t/help-me-rewrite-my-elasticsearch-query/43657/4 "2016-03-08T13:20:27Z")

</div>

It is not possible at all.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:10pm UTC](https://discuss.elastic.co/t/help-me-rewrite-my-elasticsearch-query/43657/5 "2017-07-05T23:10:22Z")

</div>