# Should inside must for multiple or conditions, not working as expected

**URL:** <https://discuss.elastic.co/t/should-inside-must-for-multiple-or-conditions-not-working-as-expected/304787>\
**Category:** Elasticsearch\
**Tags:** kql-kibana-query-language\
**Created:** [May 16, 2022, 7:24am UTC](https://discuss.elastic.co/t/should-inside-must-for-multiple-or-conditions-not-working-as-expected/304787 "2022-05-16T07:24:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_garcia/32/75104_2.png) [@Daniel\_Garcia](https://discuss.elastic.co/u/Daniel_Garcia)\
**Post date:** [May 16, 2022, 7:24am UTC](https://discuss.elastic.co/t/should-inside-must-for-multiple-or-conditions-not-working-as-expected/304787/1 "2022-05-16T07:24:43Z")

</div>

Let me explain my problem through the different cases I have.

With this query, with no filters applied, I receive results for both programs (each one belonging to each different index): `confess-chrome` && `http-down-burst-test`

 ![Captura de Pantalla 2022-05-16 a las 9.09.08](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a4e34a2cdff28af97e60876a630bdf4fd765abd.png)

If I apply a "should inside must" boolean query, where I apply same restriction to each program, I also receive results for both programs, but as expected, the average now has a value of 1:

 ![Captura de Pantalla 2022-05-16 a las 9.11.25](https://us1.discourse-cdn.com/elastic/original/3X/8/3/8367360aff46fd689367c37f4360d2ba884c098e.png)

But, in the same last query, if I apply the restriction for only one of the programs (_confess-chrome_), then I don't receive results for the other program (_http-down-burst-test_):

 ![Captura de Pantalla 2022-05-16 a las 9.11.45](https://us1.discourse-cdn.com/elastic/original/3X/8/3/83bd3827a89e535cf9ebca56d862bbbd305bd0dc.png)

If my separated restrictions by program are inside a should query, why I only receive results for one program and not the other?

How should I build my query in order to receive results for _confess-chrome_ (restricted to docs where `globales.success = 1`) and for _http-down-burst-tests_ without any restrictions applied?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2022, 7:25am UTC](https://discuss.elastic.co/t/should-inside-must-for-multiple-or-conditions-not-working-as-expected/304787/2 "2022-06-13T07:25:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.