# Multi-field search question? **URL:** \ **Category:** Elasticsearch\ **Created:** [March 6, 2013, 10:03am UTC](https://discuss.elastic.co/t/multi-field-search-question/11032 "2013-03-06T10:03:16Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ismailyenigul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismailyenigul/32/52451_2.png) [@ismailyenigul](https://discuss.elastic.co/u/ismailyenigul)\ **Post date:** [March 6, 2013, 10:03am UTC](https://discuss.elastic.co/t/multi-field-search-question/11032/1 "2013-03-06T10:03:16Z")
Hello, We are using elasticsearch to store logs.We created index for username,ip and date. We want to search users has the IP X.Y.Z.T between time1 and time2. How can I achive this with elasticsearch? Which type of query should I use? It would be great if you can provide me an example query Thanks. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 7, 2013, 9:10am UTC](https://discuss.elastic.co/t/multi-field-search-question/11032/2 "2013-03-07T09:10:49Z")
So, let's say you have documents like: { "username":"login", "ip":"127.0.0.1", "date":"2013-03-07" } Here is a full recreation Gist: [Searching with IP address and dates (logs) · GitHub](https://gist.github.com/dadoonet/5106644) Does it help? -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr | @scrutmydocs Le 6 mars 2013 à 11:03, [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit : > Hello, > > We are using elasticsearch to store logs.We created index for username,ip and date. > We want to search users has the IP X.Y.Z.T between time1 and time2. > How can I achive this with elasticsearch? Which type of query should I use? > It would be great if you can provide me an example query > > Thanks. > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![ismailyenigul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismailyenigul/32/52451_2.png) [@ismailyenigul](https://discuss.elastic.co/u/ismailyenigul)\ **Post date:** [March 19, 2013, 8:52am UTC](https://discuss.elastic.co/t/multi-field-search-question/11032/3 "2013-03-19T08:52:59Z")
Hi David, It is exactly what I was looking for. Thanks for your help. But I have another question. this query search only for IP and date. Can you give me another example to search user,ip and date in a single query. In general, How can I search more than three different field? Thanks again. 2013/3/7 David Pilato [david@pilato.fr](mailto:david@pilato.fr) > So, let's say you have documents like: > > { > "username":"login", > "ip":"127.0.0.1", > "date":"2013-03-07" > } > > Here is a full recreation Gist: [Searching with IP address and dates (logs) · GitHub](https://gist.github.com/dadoonet/5106644) > > Does it help? > > -- > _David Pilato_ | _Technical Advocate_ | _[Elasticsearch.com](http://Elasticsearch.com)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr[https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > | @scrutmydocs [https://twitter.com/scrutmydocs](https://twitter.com/scrutmydocs) > > Le 6 mars 2013 à 11:03, [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit : > > Hello, > > We are using elasticsearch to store logs.We created index for username,ip > and date. > We want to search users has the IP X.Y.Z.T between time1 and time2. > How can I achive this with elasticsearch? Which type of query should I use? > It would be great if you can provide me an example query > > Thanks. > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US](https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US) > . > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 19, 2013, 6:15pm UTC](https://discuss.elastic.co/t/multi-field-search-question/11032/4 "2013-03-19T18:15:20Z")
If you need full text search, you should look at > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. HTH -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr | @scrutmydocs Le 19 mars 2013 à 09:52, ismail yenigul [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit : > Hi David, > > It is exactly what I was looking for. Thanks for your help. > But I have another question. this query search only for IP and date. > Can you give me another example to search user,ip and date in a single query. In general, How can I search more than three different field? > > Thanks again. > > 2013/3/7 David Pilato [david@pilato.fr](mailto:david@pilato.fr) > So, let's say you have documents like: > > { > "username":"login", > "ip":"127.0.0.1", > "date":"2013-03-07" > } > > Here is a full recreation Gist: [Searching with IP address and dates (logs) · GitHub](https://gist.github.com/dadoonet/5106644) > > Does it help? > > -- > David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) > @dadoonet | @elasticsearchfr | @scrutmydocs > > Le 6 mars 2013 à 11:03, [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit : > > > Hello, > > > > We are using elasticsearch to store logs.We created index for username,ip and date. > > We want to search users has the IP X.Y.Z.T between time1 and time2. > > How can I achive this with elasticsearch? Which type of query should I use? > > It would be great if you can provide me an example query > > > > Thanks. > > > > -- > > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US](https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US). > To unsubscribe from this group and all its topics, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![ismailyenigul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismailyenigul/32/52451_2.png) [@ismailyenigul](https://discuss.elastic.co/u/ismailyenigul)\ **Post date:** [March 20, 2013, 10:23pm UTC](https://discuss.elastic.co/t/multi-field-search-question/11032/5 "2013-03-20T22:23:59Z")
Hi David, I do not need full text search. I just need to search in 3 fields (username, ip and a date range(from, to)) in a single query. Thanks 2013/3/19 David Pilato [david@pilato.fr](mailto:david@pilato.fr) > If you need full text search, you should look at > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/match-query.html) > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/multi-match-query.html) > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/query-string-query.html) > > HTH > > -- > _David Pilato_ | _Technical Advocate_ | _[Elasticsearch.com](http://Elasticsearch.com)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr[https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > | @scrutmydocs [https://twitter.com/scrutmydocs](https://twitter.com/scrutmydocs) > > Le 19 mars 2013 à 09:52, ismail yenigul [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit > : > > Hi David, > > It is exactly what I was looking for. Thanks for your help. > But I have another question. this query search only for IP and date. > Can you give me another example to search user,ip and date in a single > query. In general, How can I search more than three different field? > > Thanks again. > > 2013/3/7 David Pilato [david@pilato.fr](mailto:david@pilato.fr) > > > So, let's say you have documents like: > > > > { > > "username":"login", > > "ip":"127.0.0.1", > > "date":"2013-03-07" > > } > > > > Here is a full recreation Gist: [Searching with IP address and dates (logs) · GitHub](https://gist.github.com/dadoonet/5106644) > > > > Does it help? > > > > -- > > _David Pilato_ | _Technical Advocate_ | \*[Elasticsearch.com](http://Elasticsearch.com)[http://elasticsearch.com/](http://elasticsearch.com/) > > \* > > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr[https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > > | @scrutmydocs [https://twitter.com/scrutmydocs](https://twitter.com/scrutmydocs) > > > > Le 6 mars 2013 à 11:03, [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit : > > > > Hello, > > > > We are using elasticsearch to store logs.We created index for username,ip > > and date. > > We want to search users has the IP X.Y.Z.T between time1 and time2. > > How can I achive this with elasticsearch? Which type of query should I > > use? > > It would be great if you can provide me an example query > > > > Thanks. > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > -- > > You received this message because you are subscribed to a topic in the > > Google Groups "elasticsearch" group. > > To unsubscribe from this topic, visit > > [https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US](https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US) > > . > > To unsubscribe from this group and all its topics, send an email to > > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US](https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US) > . > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 21, 2013, 7:37am UTC](https://discuss.elastic.co/t/multi-field-search-question/11032/6 "2013-03-21T07:37:28Z")
Just add a new clause in the Gist I already provided. Do you have anything you don't understand in the Gist? -- David 😉 Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs Le 20 mars 2013 à 23:23, ismail yenigul [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit : > Hi David, > > I do not need full text search. I just need to search in 3 fields (username, ip and a date range(from, to)) in a single query. > > Thanks > > 2013/3/19 David Pilato [david@pilato.fr](mailto:david@pilato.fr) > > > If you need full text search, you should look at > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/match-query.html) > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/multi-match-query.html) > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/query-string-query.html) > > > > HTH > > > > -- > > David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) > > @dadoonet | @elasticsearchfr | @scrutmydocs > > > > Le 19 mars 2013 à 09:52, ismail yenigul [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit : > > > > > Hi David, > > > > > > It is exactly what I was looking for. Thanks for your help. > > > But I have another question. this query search only for IP and date. > > > Can you give me another example to search user,ip and date in a single query. In general, How can I search more than three different field? > > > > > > Thanks again. > > > > > > 2013/3/7 David Pilato [david@pilato.fr](mailto:david@pilato.fr) > > > > > > > So, let's say you have documents like: > > > > > > > > { > > > > "username":"login", > > > > "ip":"127.0.0.1", > > > > "date":"2013-03-07" > > > > } > > > > > > > > Here is a full recreation Gist: [Searching with IP address and dates (logs) · GitHub](https://gist.github.com/dadoonet/5106644) > > > > > > > > Does it help? > > > > > > > > -- > > > > David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) > > > > @dadoonet | @elasticsearchfr | @scrutmydocs > > > > > > > > Le 6 mars 2013 à 11:03, [ismailyenigul@gmail.com](mailto:ismailyenigul@gmail.com) a écrit : > > > > > > > > > Hello, > > > > > > > > > > We are using elasticsearch to store logs.We created index for username,ip and date. > > > > > We want to search users has the IP X.Y.Z.T between time1 and time2. > > > > > How can I achive this with elasticsearch? Which type of query should I use? > > > > > It would be great if you can provide me an example query > > > > > > > > > > Thanks. > > > > > > > > > > -- > > > > > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > > > > > > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > > > > > -- > > > > You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group. > > > > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US](https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US). > > > > To unsubscribe from this group and all its topics, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > > > -- > > > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > -- > > You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group. > > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US](https://groups.google.com/d/topic/elasticsearch/-umesHBzBYA/unsubscribe?hl=en-US). > > To unsubscribe from this group and all its topics, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:45am UTC](https://discuss.elastic.co/t/multi-field-search-question/11032/7 "2017-07-06T02:45:30Z")