How to do 2 range query like a OR condition, give result satisfy any one condition

Elastic Stack Elasticsearch
1

Hi i have 2 range queries like below

{ "range": { "@timestamp": { "gte":  "05-16-2018", "lt": "05-17-2018", "format": "MM-dd-yyyy" } }}

{ "range": { "@timestamp": { "gte":  "05-13-2018", "lt": "05-14-2018", "format": "MM-dd-yyyy" } }}

how can i create a query which give result , which satisfy any one condition ,like a OR query ?

I tried like below, but it's result was like AND condition

{  "query" :
{ "bool": { "must": [
 { "range": { "@timestamp": { "gte":  "05-16-2018", "lt": "05-17-2018", "format": "MM-dd-yyyy" } }},
 { "range": { "@timestamp": { "gte":  "05-13-2018", "lt": "05-14-2018", "format": "MM-dd-yyyy" } }}
           ]      
      }
  }

}

please help me to create query . Thanks

2

Take a look at bool query's should block: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html

3 
{  "query" :
{ "bool": { "must": [
{"bool": {                    "should": [
 { "range": { "@timestamp": { "gte":  "05-16-2018", "lt": "05-17-2018", "format": "MM-dd-yyyy" } }},
 { "range": { "@timestamp": { "gte":  "05-13-2018", "lt": "05-14-2018", "format": "MM-dd-yyyy" } }}
       ] }}     ]      
      }
  }

Is this okay ? anything wrong

4

It was missing a closing bracket at the end, other than that looks fine.

{
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "should": [
              {
                "range": {
                  "@timestamp": {
                    "gte": "05-16-2018",
                    "lt": "05-17-2018",
                    "format": "MM-dd-yyyy"
                  }
                }
              },
              {
                "range": {
                  "@timestamp": {
                    "gte": "05-13-2018",
                    "lt": "05-14-2018",
                    "format": "MM-dd-yyyy"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}
5

Thanks for the information

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.