# How can I write this search statement?

**URL:** <https://discuss.elastic.co/t/how-can-i-write-this-search-statement/34757>\
**Category:** Elasticsearch\
**Created:** [November 17, 2015, 5:31am UTC](https://discuss.elastic.co/t/how-can-i-write-this-search-statement/34757 "2015-11-17T05:31:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hacksign](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hacksign/32/5918_2.png) [@Hacksign](https://discuss.elastic.co/u/Hacksign)\
**Post date:** [November 17, 2015, 5:31am UTC](https://discuss.elastic.co/t/how-can-i-write-this-search-statement/34757/1 "2015-11-17T05:31:12Z")

</div>

Mapping :

```
{
  "information-db" : {
    "mappings" : {
      "details" : {
        "index_analyzer" : "default_index",
        "search_analyzer" : "default_search",
        "properties" : {
          "log" : {
            "type" : "nested",
            "properties" : {
              "_key_" : {
                "type" : "string"
              },
              "_type_" : {
                "type" : "string",
                "index" : "not_analyzed"
              },
              "_value_" : {
                "type" : "string",
                "fields" : {
                  "raw" : {
                    "type" : "string",
                    "index" : "not_analyzed"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

```

Data :

```
{"log":
	[
		{'_key_':['network', 'dns', 'ip'], '_value_':'8.8.8.8', '_type_':'unicode'}, 
		{'_key_':['network', 'udp'], '_value_':'1.2.3.4', '_type_':'unicode'}
	]
}

{"log":
	[
		{'_key_':['network', 'dns', 'ip'], '_value_':'8.8.8.8', '_type_':'unicode'}, 
		{'_key_':['network', 'udp'], '_value_':'7.8.9.0', '_type_':'unicode'}
	]
}

```

My search demand:  
I want get logs which are both accessed dns '8.8.8.8' and ip address '1.2.3.4'.

how can I write my dsl query statement ?

---

<div class="post-metadata">

**Author:** ![Hacksign](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hacksign/32/5918_2.png) [@Hacksign](https://discuss.elastic.co/u/Hacksign)\
**Post date:** [November 17, 2015, 8:10am UTC](https://discuss.elastic.co/t/how-can-i-write-this-search-statement/34757/2 "2015-11-17T08:10:26Z")

</div>

got it:

```
{
    "query" : {
        "bool" : {
            "must" : [
                {
                    "nested" : {
                        "path" : "log",
                        "query" : {
                            "bool" : {
                                "must" : [
                                    {"match" : {"log._key_" : {"query" : "network dns ip", "operator" : "and"}} },
                                    {"match_phrase":{"log._value_":"8.8.8.8"}}
                                ]
                            }
                        }
                    }
                },
                {
                    "nested" : {
                        "path" : "log",
                        "query" : {
                            "bool" : {
                                "must" : [
                                    {"match":{"log._key_":{"query":"network udp","operator":"and"}}},
                                    {"match_phrase":{"log._value_":"1.2.3.4"}}
                                ]
                            }
                        }
                    }
                }
            ]
        }
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:38pm UTC](https://discuss.elastic.co/t/how-can-i-write-this-search-statement/34757/3 "2017-07-05T23:38:02Z")

</div>