# Problem with multiple match query
**URL:** https://discuss.elastic.co/t/problem-with-multiple-match-query/95713
**Category:** Elasticsearch
**Created:** [August 3, 2017, 12:26pm UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713 "2017-08-03T12:26:57Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@floBoth](https://discuss.elastic.co/u/floBoth)
#### Post date: [August 3, 2017, 12:26pm UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713/1 "2017-08-03T12:26:57Z")
Hi everyone !
I think my problem is pretty simple to resolve, I want to do that (in head plugin) :
POST
/\_all/logs/\_search
{"query":{"match":{"action":"reject" OR "action":"drop" AND "src\_group":"blacklist"}},"aggregations":{"my\_aggregation":{"range":{"log\_date":{"gt":"now-24h"}}}}}
Errors are for OR, and AND in the match query.
Have you a solution please ?
Thanks !
floBoth
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [August 3, 2017, 12:49pm UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713/2 "2017-08-03T12:49:49Z")
This is not a valid JSON.
What you want to do is probably using the bool query with `must` and `should` clauses.
---
### Author:  [@floBoth](https://discuss.elastic.co/u/floBoth)
#### Post date: [August 3, 2017, 1:14pm UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713/3 "2017-08-03T13:14:51Z")
Ok thanks.
So I have done that :
{"query":{"bool":{"must":{"term":{"src\_group":"blacklist"}},"should":[{"term":{"action":"reject"}},{"term":{"action":"drop"}}]}},"aggregations":{"my\_aggregation":{"range":{"log\_date":{"gt":"now-24h"}}}}}
But another error :
"type": "search\_parse\_exception","reason": "Unexpected token START\_OBJECT in [my\_aggregation]."
Do you know where this error can come from ?
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [August 3, 2017, 3:13pm UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713/4 "2017-08-03T15:13:16Z")
Please format your code using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will make your post more readable.
Or use markdown style like:
````
```
CODE
```
````
> Do you know where this error can come from ?
Yes. It's incorrect. Look at the expected format here: [Range Aggregation | Elasticsearch Reference [5.5] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/search-aggregations-bucket-range-aggregation.html)
---
### Author:  [@floBoth](https://discuss.elastic.co/u/floBoth)
#### Post date: [August 4, 2017, 8:00am UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713/5 "2017-08-04T08:00:49Z")
I corrected my JSON code with date\_range aggregation :
```auto
{"query":
{"bool":
{"must":{"term":{"src_groupe":"blacklist"}},
"should":[{"term":{"action":"reject"}},{"term":{"action":"drop"}}]}},
"aggs":{"mon_aggregation":{
"date_range":{"field":"log_date","format":"yyyy-MM-dd",
"ranges":[{"from":"now-10M/M","to":"now/d"}]}
}}}
```
But the response isn't correct. This also returns the results where the date is not included in "from", "to".
Maybe an error in date format, or in "ranges" ?
---
### Author:  [@floBoth](https://discuss.elastic.co/u/floBoth)
#### Post date: [August 7, 2017, 8:36am UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713/6 "2017-08-07T08:36:04Z")
I tried to add "time\_zone" but that also doesn't work :
```auto
{
"query": {
"bool": {
"must": {
"term": {
"src_groupe": "blacklist"
}
},
"should": [
{
"term": {
"action": "reject"
}
},
{
"term": {
"action": "drop"
}
}
]
}
},
"aggs": {
"mon_aggregation": {
"date_range": {
"field": "log_date",
"time_zone": "CET",
"format": "yyyy-MM-dd",
"ranges": [
{
"from": "now-10M/M",
"to": "now/d"
}
]
}
}
}
}
```
Somebody can help me please ?
---
### Author:  [@floBoth](https://discuss.elastic.co/u/floBoth)
#### Post date: [August 7, 2017, 1:40pm UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713/7 "2017-08-07T13:40:30Z")
It's all good, I resolved my problem with this request :
```auto
{
"query": {
"query_string": {
"fields": [
"src_groupe",
"action"
],
"query": "blacklist OR reject OR drop"
}
},
"aggs": {
"mon_aggregation": {
"date_range": {
"field": "log_date",
"format": "yyyy-MM-dd",
"ranges": [
{
"from": "now-24M/M",
"to": "now/d"
}
]
}
}
}
}
```
Thanks !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 4, 2017, 1:40pm UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713/8 "2017-09-04T13:40:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.