# Vertical bar | in \_validate explain plan

**URL:** <https://discuss.elastic.co/t/vertical-bar-in--validate-explain-plan/59337>\
**Category:** Elasticsearch\
**Created:** [August 30, 2016, 3:59pm UTC](https://discuss.elastic.co/t/vertical-bar-in--validate-explain-plan/59337 "2016-08-30T15:59:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![EuclideanSearch](https://avatars.discourse-cdn.com/v4/letter/e/c77e96/32.png) [@EuclideanSearch](https://discuss.elastic.co/u/EuclideanSearch)\
**Post date:** [August 30, 2016, 3:59pm UTC](https://discuss.elastic.co/t/vertical-bar-in--validate-explain-plan/59337/1 "2016-08-30T15:59:11Z")

</div>

Using /events-v0-2016-08-29/systemlog/\_validate/query?explain I see

"explanations": [  
{  
"index": "events-v0-2016-08-29",  
"valid": true,  
"explanation": "filtered(+(field1:\*abc\* | field3:\*abc\*) +(field1:\*def\* | field3:\*def\*))-\>cache(\_type:systemlog)"  
}

I am trying to parse the significance of the | but I could not find it documented anywhere. Does anyone know what that is?

---

<div class="post-metadata">

**Author:** ![abeyad](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@abeyad](https://discuss.elastic.co/u/abeyad)\
**Post date:** [August 30, 2016, 6:07pm UTC](https://discuss.elastic.co/t/vertical-bar-in--validate-explain-plan/59337/2 "2016-08-30T18:07:53Z")

</div>

`|` represents a logical OR (field1 matches _abc_ OR field3 matches _abc_, in your example)

---

<div class="post-metadata">

**Author:** ![EuclideanSearch](https://avatars.discourse-cdn.com/v4/letter/e/c77e96/32.png) [@EuclideanSearch](https://discuss.elastic.co/u/EuclideanSearch)\
**Post date:** [August 30, 2016, 6:26pm UTC](https://discuss.elastic.co/t/vertical-bar-in--validate-explain-plan/59337/3 "2016-08-30T18:26:55Z")

</div>

Thank you @abeyad . I tried to 'mimic' this with a boolean query:  
{  
"query": {  
"bool": {  
"must": [  
{  
"bool": {  
"should": [  
{  
"wildcard": {  
"field1": "_abc_"  
}  
},  
{  
"wildcard": {  
"field3": "_abc_"  
}  
}  
]  
}  
},  
{  
"bool": {  
"should": [  
{  
"wildcard": {  
"field1": "_def_"  
}  
},  
{  
"wildcard": {  
"field3": "_def_"  
}  
}  
]  
}  
}  
]  
}  
}  
}

But in this case I see:  
"explanations": [  
{  
"index": "events-v0-2016-08-29",  
"valid": true,  
"explanation": "filtered(+(field1:_abc_ field3:_abc_) +(field1:_def_ field3:_def_))-\>cache(\_type:systemlog)"  
}

Specifically the '|' is missing. The queries should still be the same, is that right?

---

<div class="post-metadata">

**Author:** ![abeyad](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@abeyad](https://discuss.elastic.co/u/abeyad)\
**Post date:** [August 30, 2016, 8:28pm UTC](https://discuss.elastic.co/t/vertical-bar-in--validate-explain-plan/59337/4 "2016-08-30T20:28:49Z")

</div>

Correct, the `|` pipe syntax is generally used for the simple query string, so its probably from that, whereas your query above is combining queries so its showing them without the `|`. But it means the same. See here: [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#\_multi\_field](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_multi_field)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:23pm UTC](https://discuss.elastic.co/t/vertical-bar-in--validate-explain-plan/59337/5 "2017-07-05T22:23:52Z")

</div>