Query for X Y or Z using match

[tomer (tomer zaks)]

Continuing the discussion from Query (must be X) and (must (Z or Y):

Hi I built:

GET filebeat-*/log/_search
{
  "query": {
      "bool":{
        "must": [
          "should" : [
            {"match" :  {"clientId": "tomer"}}
          ]
        ],
      "must": [
        {"term" : {"terminationCause": "SUCCESS"}}
      ]
      
    }
  }
}

The question is there a way to use "match" for multiple terms, instead of the "terms" query?
(when I simply replace terms with "match" it doesnt work

[Tetrapack (Emmanuel Rouby)]

Hi,

You can look at the description of match query

It corresponds to a full text query, then if you want multiple values, juste put in one match query all values you want separated with a space.

Adding the "operator" field to "and" or "or" inside the match query will decide if all terms in the query should be found or not

ex:

GET filebeat-*/log/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "clientId": "tomer john billy"
          }
        }
      ]
    }
  }
}

This one will retrieve document with clientId is equal to :

• "tomer"

• "john"

• "billy"

    GET filebeat-*/log/_search
    {
      "query": {
        "bool": {
          "must": [
            {
              "match": {
                "clientId": {
                  "query": " tomer john billy",
                  "operator": "and"
                }
              }
            }
          ]
        }
      }
    }
  

this one will retrieve documents where clientId is equal to :

• "tomer john billy"

    GET filebeat-*/log/_search
    {
      "query": {
        "bool": {
          "should": [
            {
              "match": {
                "clientId": {
                  "query": " tomer john billy"
                }
              }
            }
          ],
          "minimum_should_match": 2
        }
      }
    }
  

this one will retrieve documents where clientId is equal to :

• "tomer john" or "john tomer"
• "tomer billy" or "billy tomer"
• "john billy" or "billy john"
  => The "minimum_should_match" field to 2 impose that corresponding field contains at least 2 values.

Finally, you can add a custom analyser if you wants which will split the phrase differently before searching documents.

Hope it's clear ^^'

[tomer (tomer zaks)]

@Tetrapack

Adding the “operator” field to “and” or “or” inside the ma

Thank you very much!
this was very clear