Here is one that also combines a nested, nested object. Seems to function as expected. Keep in mind the application for this would be a "global search" for the front end where the user is searching through multiple fields with the same string. I recognize how this could be done better by defining data specific to the fields in question, which we will also do in a different part of the site.
GET /sev_incidents/object/_search
{
"query": {
"bool": {
"should": [
{"query_string" : {
"query" : "*ALBANY* AND open:false",
"fields": ["number"]
}
},
{
"nested" : {
"path" : "update",
"score_mode" : "avg",
"query": {
"query_string" : {
"query" : "*ALBANY*",
"fields": ["update.level", "update.subject_line"]
}
}
}
},
{
"nested" : {
"path" : "update.sites",
"score_mode" : "avg",
"query": {
"query_string" : {
"query" : "*ALBANY*",
"fields": ["update.sites.name"]
}
}
}
}
]
}
}
}
Thanks again for the help!