# How do i convert this query into filtered query

**URL:** <https://discuss.elastic.co/t/how-do-i-convert-this-query-into-filtered-query/105074>\
**Category:** Elasticsearch\
**Created:** [October 24, 2017, 1:41pm UTC](https://discuss.elastic.co/t/how-do-i-convert-this-query-into-filtered-query/105074 "2017-10-24T13:41:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rohit\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohit_singh/32/46630_2.png) [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\
**Post date:** [October 24, 2017, 1:41pm UTC](https://discuss.elastic.co/t/how-do-i-convert-this-query-into-filtered-query/105074/1 "2017-10-24T13:41:25Z")

</div>

```auto
GET logstash-audit-*/_search
{
   "from": 0,
   "size": 100,
   "query": {
   	"bool": {
   		"must": [{
   				"bool": {
   					"should": [{
   							"term": {
   								"trans_iduid.raw": "test-000"
   							}
   						},
   						{
   							"term": {
   								"trans_idway_id.raw": 6
   							}
   						}
   					],
   					"minimum_number_should_match": 1
   				}
   			},
   			{
   				"bool": {
   					"should": [{
   							"term": {
   								"trans_id.raw": 3
   							}
   						},
   						{
   							"missing": {
   								"field": "trans_idraw"
   							}
   						}
   					],
   					"minimum_number_should_match": 1
   				}
   			}
   		],
   		"must_not": [{
   			"term": {
   				"internal_audit": true
   			}
   		}]
   	}
   	},
   "_source": ["@timestamp", "trans_id"]
}

```

---

<div class="post-metadata">

**Author:** ![polyfractal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polyfractal/32/48162_2.png) [@polyfractal](https://discuss.elastic.co/u/polyfractal)\
**Post date:** [October 27, 2017, 4:34pm UTC](https://discuss.elastic.co/t/how-do-i-convert-this-query-into-filtered-query/105074/2 "2017-10-27T16:34:42Z")

</div>

The easiest way is to just chuck it all inside a `filter` clause of another `bool` query:

```auto
GET logstash-audit-*/_search
{
  "from": 0,
  "size": 100,
  "query": {
    "bool": {
      "filter": [
        {
          "bool": {
            "must": [
              {
                "bool": {
                  "should": [
                    {
                      "term": {
                        "trans_iduid.raw": "test-000"
                      }
                    },
                    {
                      "term": {
                        "trans_idway_id.raw": 6
                      }
                    }
                  ],
                  "minimum_number_should_match": 1
                }
              },
              {
                "bool": {
                  "should": [
                    {
                      "term": {
                        "trans_id.raw": 3
                      }
                    },
                    {
                      "missing": {
                        "field": "trans_idraw"
                      }
                    }
                  ],
                  "minimum_number_should_match": 1
                }
              }
            ],
            "must_not": [
              {
                "term": {
                  "internal_audit": true
                }
              }
            ]
          }
        }
      ]
    }
  },
  "_source": [
    "@timestamp",
    "trans_id"
  ]
}

```

You could do some re-arranging, but that's the easiest way 🙂

---

<div class="post-metadata">

**Author:** ![Rohit\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rohit_singh/32/46630_2.png) [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\
**Post date:** [November 6, 2017, 5:25pm UTC](https://discuss.elastic.co/t/how-do-i-convert-this-query-into-filtered-query/105074/3 "2017-11-06T17:25:08Z")

</div>

Thanks polyfractal, that helps, Only query is that , this should be faster than a query without filter, the one which i pasted above

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2017, 5:25pm UTC](https://discuss.elastic.co/t/how-do-i-convert-this-query-into-filtered-query/105074/4 "2017-12-04T17:25:51Z")

</div>

Closed on December 4, 2017, 5:25pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.