# How do boolean predicates work in Elasticsearch query string syntax

**URL:** <https://discuss.elastic.co/t/how-do-boolean-predicates-work-in-elasticsearch-query-string-syntax/54031>\
**Category:** Elasticsearch\
**Created:** [June 27, 2016, 11:57am UTC](https://discuss.elastic.co/t/how-do-boolean-predicates-work-in-elasticsearch-query-string-syntax/54031 "2016-06-27T11:57:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![markus](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@markus](https://discuss.elastic.co/u/markus)\
**Post date:** [June 27, 2016, 11:57am UTC](https://discuss.elastic.co/t/how-do-boolean-predicates-work-in-elasticsearch-query-string-syntax/54031/1 "2016-06-27T11:57:51Z")

</div>

I have a question regarding the ES query string syntax 8Version 1.5.0). I am searching  
logstash log-entries containg xml documents and I'd like to search for  
documents containg certain XML attributes with certain values. When  
my query string looks like this:

> id: foo AND attrName="SomeValue" AND field2:bar

I get all documents where:

- id=foo  
AND
- field2=bar  
AND
- contain the text attrName AND the text SomeValue

When I change my query to (added parentheses):

> id: foo AND (attrName="SomeValue") AND field2:bar

I get all documents where:

- id=foo  
AND
- field2=bar  
AND
- contain the text attrName OR the text SomeValue

Why is (attrName="SomeValue") evaluated as attrName OR SomeValue, whereas without parentheses it is attrName AND SomeValue?

My search JSON is:

> {  
> "sort": [  
> "@timestamp"  
> ],  
> "query": {  
> "query\_string": {  
> "query": "mySearchText"  
> }  
> },  
> "fields": [  
> "\_id"  
> ],  
> "size": 100  
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:40pm UTC](https://discuss.elastic.co/t/how-do-boolean-predicates-work-in-elasticsearch-query-string-syntax/54031/2 "2017-07-05T22:40:18Z")

</div>