# Query (must be X) and (must (Z or Y)

**URL:** https://discuss.elastic.co/t/query-must-be-x-and-must-z-or-y/87855
**Category:** Elasticsearch
**Created:** [June 1, 2017, 7:45am UTC](https://discuss.elastic.co/t/query-must-be-x-and-must-z-or-y/87855 "2017-06-01T07:45:14Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)
#### Post date: [June 1, 2017, 7:45am UTC](https://discuss.elastic.co/t/query-must-be-x-and-must-z-or-y/87855/1 "2017-06-01T07:45:14Z")

</div>

I am trying to build a query that a certain term (terminationCause) will be success. And that a different term (clientId) will equal either (OR) X Y or Z (but not A or B)

What I built is (ofcourse this doesn't work):

```
GET filebeat-*/log/_search
{
  "query": {
      "bool":{
        "must": [
          "should" : [
            {"match" : {"clientId": "tomer"}}
          ]
        ],
      "must": [
        {"term" : {"terminationCause": "SUCCESS"}}
      ]
      
    }
  }
}

```

I will be happy for any help on the subject.

---

<div class="post-metadata">

### Author: ![Tetrapack](https://avatars.discourse-cdn.com/v4/letter/t/85f322/32.png) [@Tetrapack](https://discuss.elastic.co/u/Tetrapack)
#### Post date: [June 1, 2017, 8:05am UTC](https://discuss.elastic.co/t/query-must-be-x-and-must-z-or-y/87855/2 "2017-06-01T08:05:04Z")

</div>

```
GET filebeat-*/log/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "terminationCause": {
              "value": "SUCCESS"
            }
          }
        },{
          "terms": {
            "clientId": [
              "X",
              "Y",
              "Z"
            ]
          }
          
        }
      ]
    }
  }
}

```

This query will retrieve documents with terminationCause = "SUCCESS" and clientsId equals to X, Y or Z

Then A and B will automatically be avoided.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2017, 8:05am UTC](https://discuss.elastic.co/t/query-must-be-x-and-must-z-or-y/87855/3 "2017-06-29T08:05:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.