example:
GET filebeat*/_search
{
"query": {
"bool": {
"must": [
{
"match": {
"stream": "stderr"
}
},
{
"range": {
"@timestamp": {
"gte": "now-24h"
}
}
}
],
"must_not": [
{
"q": "message:Foo+Bar",
"language": "lucene"
}
]
}
}
}
Would something like this be possible?
I know I could convert this lucene syntax in the ES Query DSL, but I'd like to use several queries defined in Lucene syntax, programmatically