# How to merge the two query syntax **URL:** \ **Category:** Elasticsearch\ **Created:** [December 29, 2017, 6:55am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540 "2017-12-29T06:55:42Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [December 29, 2017, 6:55am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540/1 "2017-12-29T06:55:42Z")
I have two syntax to query, and I want to merge them together, so I need only query one time . How can I do it? this is my restful api: ``` GET _search { "size" : 0, "query": { "bool": { "must": [ { "match" : { "_index" : "logstash-2017.12.29" } }, { "match_phrase":{"IPV4_DST_ADDR":"120.127.182.114"} }, { "range" : { "LAST_SWITCHED" : { "gte" : 1514513376 } } } ] } }, "aggs": { "IN_PKTS": { "sum": { "field": "IN_PKTS" } }, "IN_BYTES": { "sum": { "field": "IN_BYTES" } }, "OUT_BYTES": { "sum": { "field": "OUT_BYTES" } }, "OUT_PKTS": { "sum": { "field": "OUT_PKTS" } }, "genres":{ "terms" : { "field" : "L7_PROTO_NAME.keyword", "order" : { "in_bytes" : "desc" } }, "aggs":{ "in_bytes": { "sum": { "field":"IN_BYTES"} } } }, "Udp|Tcp" : { "terms" : { "field" : "PROTOCOL" } }, "Using_port_count" : { "cardinality" : { "field" : "L4_SRC_PORT" } } } } ``` and I want to change the IPV4\_DST\_ADDR field to IPV4\_SRC\_ADDR and query again. thank you in advance:slight\_smile: ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [December 29, 2017, 7:24am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540/2 "2017-12-29T07:24:21Z")
Hi 張皓翔, If I understand your question correctly you want to search for all entries that match either `IPV4_DST_ADDR` or `IPV4_SRC_ADDR` to be `120.127.182.114`. As these are IP addresses, I'd recommend storing them in a field with the [IP data type](https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html). This will allow you to query for subnets in addition to exact IP addresses. Your query should contain a `should` [boolean query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html) block, such as ```auto "bool": { "should": [ { "term": { "IPV4_DST_ADDR": { "value": "120.127.182.114" } } }, { "term": { "IPV4_SRC_ADDR": { "value": "120.127.182.114" } } } ], "minimum_should_match": 1 } ``` Also, rather than matching on the value of the `_index` field, please invoke the REST API call on the index name directly: ```auto GET logstash-2017.12.29/_search { ... query goes here ... } ``` ---
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [December 29, 2017, 7:30am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540/3 "2017-12-29T07:30:57Z")
yes. it's very closely. and when I query the IPV4\_SRC\_ADDR:120.127.182.114 I want to count: ``` "aggs":{ "in_bytes": { "sum": { "field":"IN_BYTES"} //change to OUT_BYTES } } } ``` thank you 🙂 ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [December 29, 2017, 7:42am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540/4 "2017-12-29T07:42:18Z")
Simply add another aggregation into the same `aggs` block? ```auto "aggs":{ "in_bytes": { "sum": { "field":"IN_BYTES" } }, "out_bytes": { "sum": { "field": "OUT_BYTES" } } } ``` ---
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [December 29, 2017, 7:48am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540/5 "2017-12-29T07:48:02Z")
yes, my code is the same with you . but it can't distinguish in\_bytes and out\_bytes belongs to IPV4\_SRC\_ADDR:120.127.182.114 or IPV4\_DST\_ADDR:120.127.182.114 because I want to sum: IPV4\_SRC\_ADDR:120.127.182.114 in\_bytes+IPV4\_DST\_ADDR:120.127.182.114 out\_bytes ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [December 29, 2017, 7:54am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540/6 "2017-12-29T07:54:18Z")
Have a look at [Filter Aggregations](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filter-aggregation.html). You'll have to set up different aggregations for `IPV4_DST_ADDR` and `IPV4_SRC_ADDR`, and apply the appropriate filter for each. ---
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [December 29, 2017, 10:37am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540/7 "2017-12-29T10:37:49Z")
great thank you! this is the answer way. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 26, 2018, 10:37am UTC](https://discuss.elastic.co/t/how-to-merge-the-two-query-syntax/113540/8 "2018-01-26T10:37:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.