# Refactor massive nested bool query es@5.6

**URL:** <https://discuss.elastic.co/t/refactor-massive-nested-bool-query-es-5-6/158662>\
**Category:** Elasticsearch\
**Created:** [November 28, 2018, 11:04pm UTC](https://discuss.elastic.co/t/refactor-massive-nested-bool-query-es-5-6/158662 "2018-11-28T23:04:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jbinquef](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jbinquef](https://discuss.elastic.co/u/jbinquef)\
**Post date:** [November 28, 2018, 11:04pm UTC](https://discuss.elastic.co/t/refactor-massive-nested-bool-query-es-5-6/158662/1 "2018-11-28T23:04:58Z")

</div>

Is there a way to better structure this nested boolean query? We are running into the max bool clause count. I've looked into trying to use a termquery and termsquery, but I'm not sure it makes sense in this situation. The end result query ends up being over 700k lines.

So far I've refactored each nested bool query for each range into a top level bool query with a list of all the ranges. However, we are still hitting the max bool clause exception.

1. Does each range under the bool get evaluated as a separate bool clause?
2. I'm trying to get past the max clause count without changing the setting in the .yml file.

Example (there are more ranges):

```
{
  "bool" : {
    "must" : [
      {
        "bool" : {
          "should" : [
            {
              "bool" : {
                "must" : [
                  {
                    "bool" : {
                      "should" : [
                        {
                          "nested" : {
                            "query" : {
                              "bool" : {
                                "must" : [
                                  {
                                    "range" : {
                                      "srcAddrIndex.startAddressIp" : {
                                        "from" : null,
                                        "to" : "::ffff:10.0.0.255",
                                        "include_lower" : true,
                                        "include_upper" : true,
                                        "boost" : 1.0
                                      }
                                    }
                                  },
                                  {
                                    "range" : {
                                      "srcAddrIndex.endAddressIp" : {
                                        "from" : "::ffff:10.0.0.0",
                                        "to" : null,
                                        "include_lower" : true,
                                        "include_upper" : true,
                                        "boost" : 1.0
                                      }
                                    }
                                  },
                                  {
                                    "range" : {
                                      "srcAddrIndex.startAddressIp" : {
                                        "from" : null,
                                        "to" : "::ffff:192.0.6.1",
                                        "include_lower" : true,
                                        "include_upper" : true,
                                        "boost" : 1.0
                                      }
                                    }
                                  },

```

Previous query snippit:

```
{
  "bool": {
    "should": [
      {
        "bool": {
          "filter": [
            {
              "bool": {
                "should": [
                  {
                    "nested": {
                      "query": {
                        "bool": {
                          "must": [
                            {
                              "range": {
                                "srcAddrIndex.startAddressIp": {
                                  "from": null,
                                  "to": "::ffff:1.1.1.255",
                                  "include_lower": true,
                                  "include_upper": true,
                                  "boost": 1
                                }
                              }
                            },
                            {
                              "range": {
                                "srcAddrIndex.endAddressIp": {
                                  "from": "::ffff:1.1.1.0",
                                  "to": null,
                                  "include_lower": true,
                                  "include_upper": true,
                                  "boost": 1
                                }
                              }
                            }
                          ],
                          "disable_coord": false,
                          "adjust_pure_negative": true,
                          "boost": 1
                        }
                      },
                      "path": "srcAddrIndex",
                      "ignore_unmapped": false,
                      "score_mode": "none",
                      "boost": 1
                    }
                  },
                  {
                    "nested": {
                      "query": {
                        "bool": {
                          "must": [
                            {
                              "range": {
                                "srcAddrIndex.startAddressIp": {
                                  "from": null,
                                  "to": "::ffff:1.2.3.255",
                                  "include_lower": true,
                                  "include_upper": true,
                                  "boost": 1
                                }
                              }
                            },
                            {
                              "range": {
                                "srcAddrIndex.endAddressIp": {
                                  "from": "::ffff:1.2.3.0",
                                  "to": null,
                                  "include_lower": true,
                                  "include_upper": true,
                                  "boost": 1
                                }
                              }
                            }
                          ],
                          "disable_coord": false,
                          "adjust_pure_negative": true,
                          "boost": 1
                        }
                      },
                      "path": "srcAddrIndex",
                      "ignore_unmapped": false,
                      "score_mode": "none",
                      "boost": 1
                    }
                  },
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2018, 11:05pm UTC](https://discuss.elastic.co/t/refactor-massive-nested-bool-query-es-5-6/158662/2 "2018-12-26T23:05:04Z")

</div>

Closed on December 26, 2018, 11:05pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.