Query (must be X) and (must (Z or Y)

Elastic Stack Elasticsearch
2 
GET filebeat-*/log/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "terminationCause": {
              "value": "SUCCESS"
            }
          }
        },{
          "terms": {
            "clientId": [
              "X",
              "Y",
              "Z"
            ]
          }
          
        }
      ]
    }
  }
}

This query will retrieve documents with terminationCause = "SUCCESS" and clientsId equals to X, Y or Z

Then A and B will automatically be avoided.

1 Like