Request of field + value & samefield + anothervalue combinations using bool must or query_string - ask for help

Elastic Stack Elasticsearch
1

Hi,
i just tried to build following request to count documents containing player active status but no match found:

GET /players/_search    
{
  "size": 0,
  "query": {
    "bool": {
        "must" : [
            {"terms" : { "player" : ["576","234"]}},
            {"terms": { "active": ["y", "z"]}}
        ]
    }
  }
}

Ends up in zero hits!

Ok then I tried this to test wheter one of each serves a result:

GET /players/_search
{
  "size": 10,
    "query": {
        "query_string" : {
            "fields" : ["player", "active"],
            "query" : "576 AND y"
        }
    }
}

"hits" : {
    "total" : {
      "value" : 56,
      "relation" : "eq"
    },

then 

GET /players/_search
{
  "size": 10,
    "query": {
        "query_string" : {
            "fields" : ["player", "active"],
            "query" : "234 AND z"
        }
    }
}

"hits" : {
    "total" : {
      "value" : 13,
      "relation" : "eq"
    },

But I need booth in combination to the other which should end in 2 hits
means this 2 different players had an active status of y and z at the same time
and I need to find them to build testcases.

How can I ?
Thanks and Brdgs

2

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

3

Hi David,
I'll try:

ES v7.5.1

My Mapping:

{
  "players" : {
    "mappings" : {
      "properties" : {
        "@timestamp" : {
          "type" : "date"
        },
        "@version" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "player" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "active" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "server" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        }
      }
    }
  }
}

Cause I'm not sure how to create a recreation script to match all I want I try to explain this way:

grafik

I want to find the "4" and or the "2" depending on output fields:

},"_source": ["server", "player"]

or
},"_source": ["server"]

or
},"_source": ["player"]

I hope this is a little more understandable.

Thanks
Regards

4

Please provide something we can use to reproduce and fix your problem.
We can make some assumptions but it's easier and faster if you provide everything we just have to copy/paste and run.

As the example I shared (see the link), you should have in the script:

  • delete index
  • index creation with mappings if any
  • documents creation
  • search requests

Thanks

5

HI dadoonet,
first thanks for your reply and appologize my late!
I do trie to explain what I meant but due to my lack of knowledge of how ES is working behind the scene when writing an index my pain ends in how to explain the case and further I thought that might be more a Kibana question.

Therefore closed here and thanks
Regards

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.