# What's wrong with my query?

**URL:** <https://discuss.elastic.co/t/whats-wrong-with-my-query/181224>\
**Category:** Elasticsearch\
**Created:** [May 15, 2019, 2:56pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-query/181224 "2019-05-15T14:56:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidbien](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@davidbien](https://discuss.elastic.co/u/davidbien)\
**Post date:** [May 15, 2019, 2:56pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-query/181224/1 "2019-05-15T14:56:23Z")

</div>

I'm trying to search through documents using an equivalent of logical OR in elasticsearch.  
From the docs I understand I should use `should`, however when I run it I get all documents, none of them meeting my requirements in OR.

```
"query": {
        "bool": {
            "should": [
                {"match": {"eventName": "AuthorizeSecurityGroupIngress"}},
                {"match": {"eventName": "AuthorizeSecurityGroupEgress"}},
                {"match": {"eventName": "RevokeSecurityGroupIngress"}},
                {"match": {"eventName": "RevokeSecurityGroupEgress"}}
            ],
            "filter": {
                "range": {
                    "eventTime": {
                        "gte":"now-5h",
                        "lt":"now"
                    }
                }
            }
        }
    }

```

With this I get eventNames that are not in the query above. What is wrong with it?

---

<div class="post-metadata">

**Author:** ![whatgeorgemade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whatgeorgemade/32/103246_2.png) [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\
**Post date:** [May 15, 2019, 3:41pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-query/181224/2 "2019-05-15T15:41:02Z")

</div>

Hi there,

There's more nuance to the `should` clause than meets the eye; it's not always the equivalent of a logical OR.

In your query, because of the way the `should` clause works, none of the documents matching the `filter` actually have to match any of the `should` clauses. All the `should` clause will do is increase the score of the matched documents.

To make sure you **only** get documents matching at least one of the clauses in the `should` block, add a `minimum_should_match` clause with a value of `1`.

Weirdly, the v7 docs don't describe this behaviour but it is mentioned in the v6.7 docs (unless the behaviour has changed between releases, which I don't think is the case). Look at the description of `should` on this page: [https://www.elastic.co/guide/en/elasticsearch/reference/6.7/query-dsl-bool-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.7/query-dsl-bool-query.html)

Hope this helps.

---

<div class="post-metadata">

**Author:** ![davidbien](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@davidbien](https://discuss.elastic.co/u/davidbien)\
**Post date:** [May 16, 2019, 10:49am UTC](https://discuss.elastic.co/t/whats-wrong-with-my-query/181224/3 "2019-05-16T10:49:39Z")

</div>

Hi George,

Thank you for showing me this. It makes more sense now and I got it to work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2019, 10:49am UTC](https://discuss.elastic.co/t/whats-wrong-with-my-query/181224/4 "2019-06-13T10:49:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.