I'm trying to search through documents using an equivalent of logical OR in elasticsearch.
From the docs I understand I should use should
, however when I run it I get all documents, none of them meeting my requirements in OR.
"query": {
"bool": {
"should": [
{"match": {"eventName": "AuthorizeSecurityGroupIngress"}},
{"match": {"eventName": "AuthorizeSecurityGroupEgress"}},
{"match": {"eventName": "RevokeSecurityGroupIngress"}},
{"match": {"eventName": "RevokeSecurityGroupEgress"}}
],
"filter": {
"range": {
"eventTime": {
"gte":"now-5h",
"lt":"now"
}
}
}
}
}
With this I get eventNames that are not in the query above. What is wrong with it?