This works well:
DELETE test
PUT test/doc/1
{
"level": ["DEBUG", "INFO"]
}
PUT test/doc/2
{
"level": ["ERROR", "INFO"]
}
PUT test/doc/3
{
"level": ["INFO"]
}
GET test/_search
{
"query": {
"bool": {
"must": [
{
"term": {
"level": {
"value": "debug"
}
}
}, {
"term": {
"level": {
"value": "info"
}
}
}
]
}
}
}
And gives:
{
"took": 6,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 0.5753642,
"hits": [
{
"_index": "test",
"_type": "doc",
"_id": "1",
"_score": 0.5753642,
"_source": {
"level": [
"DEBUG",
"INFO"
]
}
}
]
}
}
First thing to do is to reproduce the problem with just a script like I did. Then try to understand what is wrong.
Here, I'm almost sure (but you did not share your mapping), that you are searching on a text
field with default analyzer, using a term
query with uppercase terms like DEBUG
and INFO
. Which is not going to work.