How to query multiple fileds in Kibana

Elastic Stack Elasticsearch
21

I just did change both servicename and servername to keyword then ran the query again without any luck. I keep getting correlationids that are not in the terms array

22

The query I ran after changing to keyword

GET unity/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "2020-04-01",
              "lte": "2022-07-01"
            }
          }
        }
      ], 
      "must": [
        {
          "match": {
            "serviceName": "Serviceworker"
          }
        }
      ],
      "should": [
        {
          "terms": {
            "correlationId": [
              "085178d5-e782-4ad9-a56a-5c08d906686d",
              "01b4ac00-1c67-4056-a571-455f9fd1c296"
            ]
            
            
          }
          
        }
        
        
        
      ],
      "minimum_should_match": 1
    }
    
  }
  
}

Result

{
  "took" : 835,
  "timed_out" : false,
  "_shards" : {
    "total" : 110,
    "successful" : 110,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  }
}
23

As I said before, please isolate the problem as far as you can. For example, try simple match query and terms query those included in boolean query to confirm both queries work well separetely. If one of them does not return the desired document, we can concentrate on that part.

24

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.