Search query for either of the value matches


#1

Hey, search query doesn't return either of the values

GET /_search
{
"query": {
"bool": {
"must": [
{
"term": {
"source": "/var/log/elasticsearch/server1/xxx-1.log"
}
},
{
"term": {
"source": "/var/log/elasticsearch/server2/xxx-1.log"
}
},
{
"term": {
"source": "/var/log/elasticsearch/server3/xxx-1.log"
}
}
]
}
}
}

This works if the source field must match 3 values?? I want to get the indices that match any value of the 3 paths specified. Is there any other way?


(Jaspreet Singh) #2

Change must clause to should. It will return all documents that match at least one of these 3. Documents that match more clauses will get higher scores and hence ranks.


#3

Thanks!


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.