# Must condition with OR condition
**URL:** https://discuss.elastic.co/t/must-condition-with-or-condition/164654
**Category:** Elasticsearch
**Created:** [January 17, 2019, 2:45pm UTC](https://discuss.elastic.co/t/must-condition-with-or-condition/164654 "2019-01-17T14:45:34Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Chaitanya1](https://discuss.elastic.co/u/Chaitanya1)
#### Post date: [January 17, 2019, 2:45pm UTC](https://discuss.elastic.co/t/must-condition-with-or-condition/164654/1 "2019-01-17T14:45:34Z")
Hi Team,
I want to optimize the watcher scripts created. I created almost 21 scripts with different message patterns.
My aim is to reduce the number of scripts.
I want to change the must match pattern with OR condition.
"must": [
{
"match\_phrase": {
"app.name": "mlm?-\*"
}
},
{
"match\_phrase": {
"level": "warn"
}
}
],
"must\_not": [
{
"match\_phrase": {
"logger\_name": "org.hibernate.orm.deprecation"
}
},
{
However, i could observe that Must operates with AND logic. If i enter many must conditions , script checks for all conditions. My aim is to use OR logic.
Example - must "Account locked" or must "database connection lost" . Action (email) should be triggered if logs has any one of the message.
Please help. Thanks in advance.
---
### Author:  [@madhan3396](https://discuss.elastic.co/u/madhan3396)
#### Post date: [January 17, 2019, 4:34pm UTC](https://discuss.elastic.co/t/must-condition-with-or-condition/164654/2 "2019-01-17T16:34:43Z")
Use should instead of must.
```
{
"query":{
"bool":{
"should":[
{"term":{"AccountLocked":"true"}},
{"term":{"DatabaseConnection":"lost"}}
],
"minimum_should_match" : 1
}
}}
```
minimum\_should\_match = 1, says that either 1 termsquery in the should should satisfy.
---
### Author:  [@Chaitanya1](https://discuss.elastic.co/u/Chaitanya1)
#### Post date: [January 18, 2019, 5:52am UTC](https://discuss.elastic.co/t/must-condition-with-or-condition/164654/3 "2019-01-18T05:52:27Z")
Thank you Madhan. I will try as you said and let you know the result.
---
### Author:  [@Chaitanya1](https://discuss.elastic.co/u/Chaitanya1)
#### Post date: [January 19, 2019, 5:56am UTC](https://discuss.elastic.co/t/must-condition-with-or-condition/164654/4 "2019-01-19T05:56:24Z")
Hi Madhan,
I tried the Should clause in the script. However, the script is only searching for one term. When logs has both Account locked and Database connection lost. The alert is not showing the result with 2 details
Attached the script
Please let me know where exactly i am doing wrong.
{
"trigger": {
"schedule": {
"interval": "10m"
}
},
"input": {
"search": {
"request": {
"search\_type": "query\_then\_fetch",
"indices": [
"pc-prod\*"
],
"types": ,
"body": {
"query": {
"bool": {
"should": [
{
"match": {
"message": "Heartbeat"
}
},
{
"match": {
"message": "DataSource"
}
}
],
"filter": {
"range": {
"@timestamp": {
"from": "now-10m",
"to": "now"
}
}
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"send\_email": {
"email": {
"profile": "standard",
"attachments": {
"Error\_Details": {
"data": {
"format": "json"
}
}
},
"priority": "high",
"to": [
"[abc.com](http://abc.com)"
],
"subject": "MLM - PROD - {{ctx.payload.hits.hits.\_source.beat.hostname}} -or logic",
"body": {
"text": "Hi Team, \n\n {{ctx.payload.hits.hits.\_source.beat.hostname}} \n\n Please check attachment for more details \n\n Log Details:\nCount : {{ctx.payload.hits.total}}\n {{ctx.payload.hits.hits.0.\_source.message}}"
}
}
}
}
}
---
### Author:  [@madhan3396](https://discuss.elastic.co/u/madhan3396)
#### Post date: [January 21, 2019, 4:53am UTC](https://discuss.elastic.co/t/must-condition-with-or-condition/164654/5 "2019-01-21T04:53:20Z")
Hi
Where is **"minimum\_should\_match":1** in your part of query?
Try giving that too.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 18, 2019, 4:53am UTC](https://discuss.elastic.co/t/must-condition-with-or-condition/164654/6 "2019-02-18T04:53:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.