Hi,
I'm trying to get a query to do a must on some fields and then a should on two more fields, but the should matches even if none of the conditions really match.
What I'd like to have is something like:
field: text AND field1:text AND field2: text AND (field3: text OR field4: text)
So at least one of the ORs should be present in the document for the query to match.
The query is:
{"fields":
["logical_name.raw","serial_number.raw","dco_config_admin_group.raw","status.raw","warranty_vendor.raw","warranty_startdate.raw","warranty_enddate.raw","warranty_type.raw","warranty_uplift","maint_vendor.raw","maint_startdate.raw","maint_enddate.raw","maint_type.raw","datacenter_label.raw","manufacturer.raw","hardware_model.raw","environment.raw","sbu.raw","bu.raw","bu2.raw","product_name.raw"],
"query": {
"bool":{
"must":[
{
"match": {"timestamp": "2016-08-15"}
},
{
"match": {"sbu.raw": "F&R"}
}
],
"should": [
{
"exists": { "field": "warranty_vendor.raw" }
},
{
"exists": { "field": "maint_vendor.raw" }
}
]
}
}
}
How can I change that should to make it act as I want it to?
Thanks,
Isaac