# How to search using boolean operators AND, OR or Not in dev tools? **URL:** \ **Category:** Elasticsearch\ **Created:** [July 9, 2019, 8:33am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485 "2019-07-09T08:33:36Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 9, 2019, 8:33am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/1 "2019-07-09T08:33:37Z")
Hello, Can anyone help me to use Boolean search in dev tools query? Thanks, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 9, 2019, 8:54am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/2 "2019-07-09T08:54:33Z")
What did you try so far? ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 9, 2019, 9:04am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/3 "2019-07-09T09:04:59Z")
Hello @dadoonet, I have tried below query: > POST /multipletable/\_search > { > "query":{ > "bool":{ > "must":[ { > "match":{ > "title":{ > "query":"test"} } }, > { > "match":{ > "contentid":{ > "query":"4016768"} } } > ] > } > } > } in above query, i have mentioned in which field i have to search, like search for test in title field AND search for 4016768 in contentid. i dont want to use field name but have to perform boolean search in below format query: > GET new\_database,new\_attachment/\_search?size=10000 > { > "query": { > "multi\_match": { > "query": "4245489", > "fields": ["contentid^5", "title^4","object\_summary^3","content^2","submitted\_for\_name"] } > } > } Regards, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 9, 2019, 9:17am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/4 "2019-07-09T09:17:42Z")
Could you replace the 2 match queries with 2 simple query string queries instead? ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 9, 2019, 9:33am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/5 "2019-07-09T09:33:55Z")
Hello @dadoonet, Like this: "query\_string": { "query": "test AND 4016768" } Regards, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 9, 2019, 9:08pm UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/6 "2019-07-09T21:08:37Z")
Yes but I meant [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-simple-query-string-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-simple-query-string-query.html) But your way should work as well. ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 11, 2019, 5:29am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/7 "2019-07-11T05:29:24Z")
Hello @dadoonet, Thanks for reply!! i have tried using simple query string query. It is working fine for me. one more doubt, in kibana when we do boolean search through index pattern, so Is it always necessary to mention field name first before using any boolean operator? example: Field1: SearchTerm1 AND Field2: SearchTerm2 Is there any way to do boolean search without using fields? i want to apply boolean search for all the field. I have tried using SearchTerm1 AND SearchTerm2, but it is considering AND as a word and giving me incorrect results. Regards, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 11, 2019, 8:14am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/8 "2019-07-11T08:14:11Z")
I believe it's because Kibana is using by default the KQL language which is slightly different perhaps than the Lucene query language. There is an option to change it (a small arrow at the right of the search box IIRC). ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 11, 2019, 8:56am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/9 "2019-07-11T08:56:51Z")
Hello @dadoonet, i am not able to see arrow. > ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/8364c5ea1713e335fab446b89f8752326e5258a6.png) Regards, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 11, 2019, 9:23am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/10 "2019-07-11T09:23:55Z")
Because you are using an old version. May be try the options but I think you are using Lucene query language by default in this version. So that should work out of the box. What exactly did you enter? ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 11, 2019, 10:36am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/11 "2019-07-11T10:36:05Z")
Hello @dadoonet, I have enter Boolean search query . for example: Test AND testing. I am able to search now. My another doubt is i am using NOT operator in both ways. It should return me same number of results. but both are showing different result count. please find below > 1st way: > GET new\_database,new\_attachment/\_search?size=10000 > { > "query": { > "simple\_query\_string": { > "query": "KPOD - 4245489", > "fields": ["contentid^5", "title^4","object\_summary^3","content^2","submitted\_for\_name"] } > } > } > 2nd way: > GET new\_database,new\_attachment/\_search?size=10000 > { > "query": { > "query\_string": { > "query": "KPOD NOT 4245489", > "fields": ["contentid^5", "title^4","object\_summary^3","content^2","submitted\_for\_name"] } > } > } This is "KPOD - 4245489" same as "KPOD NOT 4245489". Regards, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 11, 2019, 1:10pm UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/12 "2019-07-11T13:10:16Z")
Try ``` KPOD -4245489 ``` ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 11, 2019, 2:51pm UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/13 "2019-07-11T14:51:25Z")
Hello @dadoonet, Nope, still wrong count!!! Regards, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 11, 2019, 4:39pm UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/14 "2019-07-11T16:39:10Z")
Could you provide a full recreation script as described in [About the Elasticsearch category](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will help to better understand what you are doing. Please, try to keep the example as simple as possible. A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer. ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 15, 2019, 8:47am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/15 "2019-07-15T08:47:38Z")
Hello @dadoonet, I have tried solution that you have mentioned in above replies. please find below code for your reference: ``` GET new_database,new_attachment/_search?size=10000 { "query": { "simple_query_string": { "query": "KPOD -4245489", "fields": ["contentid^5", "title^4","object_summary^3","content^2","submitted_for_name"] } } } ``` still i am getting wrong result count. "query": "KPOD -4245489" and "query": "KPOD NOT 4245489" should work as same. correct if i am wrong. using "query": "KPOD NOT 4245489" i am getting 1541 results. but using "query": "KPOD -4245489" i am getting more than 1541. Kindly guide me on the same. Regards, Priyanka Y. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 15, 2019, 9:39am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/16 "2019-07-15T09:39:18Z")
Could you provide a full recreation script as described in [About the Elasticsearch category](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will help to better understand what you are doing. Please, try to keep the example as simple as possible. A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer. ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 15, 2019, 10:16am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/17 "2019-07-15T10:16:25Z")
Hello @dadoonet, I have explained using script. what do you want me to explain more on the same? Thanks, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 15, 2019, 11:55am UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/18 "2019-07-15T11:55:20Z")
In case you did not see it, let me copy the text: Providing a script to reproduce locally is definitely helping a lot to get quicker and more accurate responses. Please format your code using `` icon and produce full scripts like this one: ```auto DELETE index PUT index/_doc/1 { "foo": "bar" } GET index/_search { "query": { "match": { "foo": "bar" } } } ``` A typical script like this one can be copied and pasted in Kibana Dev Console by any reader. It will definitely help to play with your example and provide a fix for your script. **If you don't provide it, there is a chance that nobody can help**. ---
**Author:** ![pyerunka](https://avatars.discourse-cdn.com/v4/letter/p/d6d6ee/32.png) [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Post date:** [July 15, 2019, 12:12pm UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/19 "2019-07-15T12:12:24Z")
Hello @dadoonet, I have updated my post using \. kindly check. Regards, Priyanka ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [July 15, 2019, 1:14pm UTC](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485/20 "2019-07-15T13:14:21Z")
Running ``` GET new_database,new_attachment/_search?size=10000 ``` On my machine is giving me that indices do not exist. So I can't reproduce. Do you understand what I'm meaning? [Next page](https://discuss.elastic.co/t/how-to-search-using-boolean-operators-and-or-or-not-in-dev-tools/189485.md?page=2)