# Query DSL, Boolean query. Multiple conditions for must\_not

**URL:** https://discuss.elastic.co/t/query-dsl-boolean-query-multiple-conditions-for-must-not/263004
**Category:** Elasticsearch
**Created:** [February 2, 2021, 3:10pm UTC](https://discuss.elastic.co/t/query-dsl-boolean-query-multiple-conditions-for-must-not/263004 "2021-02-02T15:10:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![gneves](https://avatars.discourse-cdn.com/v4/letter/g/3da27b/32.png) [@gneves](https://discuss.elastic.co/u/gneves)
#### Post date: [February 2, 2021, 3:10pm UTC](https://discuss.elastic.co/t/query-dsl-boolean-query-multiple-conditions-for-must-not/263004/1 "2021-02-02T15:10:15Z")

</div>

Hello guys, hope you are doing well and healthy.

Im having a little trouble using DSL querys.  
My objective is this:  
I want to trigger an event that,  
the action must be "UserLoggedIn",  
the country must NOT be Portugal, and i also want to add some exceptions.  
The following query actually works, but i dont know, or i cant add some of the exceptions i want.

So, imagine, i dont want to trigger if the user is "[john@hotmail.com](mailto:john@hotmail.com)" and the country is "Germany". with the following query im not triggering any kind of logs from "[john@hotmail.com](mailto:john@hotmail.com)", and i need to add inside each exception, the country verification.

And if there was an event from "[john@hotmail.com](mailto:john@hotmail.com)" and the country "Spain", the event would still trigger. Thats what i mean.

Let me know if my explanation is not clear.

My query:

```auto
    "body": {
                "query": {
                  "bool": {
                    "must": [
                      {
                        "match": {
                          "event.action": "UserLoggedIn"
                        }
                      },
                      {
                        "range": {
                          "logstash_processed_at": {
                            "gte": "now-1m",
                            "lte": "now"
                          }
                        }
                      }
                    ],
                    "must_not": [
                      {
                        "match": {
                          "geoip.country_name": "Portugal"
                        }
                      },
                      {
                        "match": {
                          "user.id": "john@hotmail.com"
                        }
                      },
                      {
                        "match": {
                          "user.id": "michael@hotmail.com"
                        }
                      },
                      {
                        "match": {
                          "user.id": "william@hotmail.com"
                        }
                      }
                    ]
                  }
                }
            

```

I have already read some of the documentation, in order to understand. and i didnt found yet something that would fill my requirements. If there is something that i must read before doing this, i'm open to it!  
Thank you so much for your help 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 2, 2021, 3:11pm UTC](https://discuss.elastic.co/t/query-dsl-boolean-query-multiple-conditions-for-must-not/263004/2 "2021-03-02T15:11:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.