Dears,
I need your advice/explanation.
This is my query which select document from index which not include field f1.rc. I don't understand why.
What is wrong in below query? Any idea?
In my opinion this query should select documents that meet both conditions f1.rc and f1.mti. I'm confused.
GET /index-2022.04.14/_search?size=100&pretty=true
{
"query": {
"bool": {
"must": [
{
"match": {
"f1.iface.keyword":"MOSS"
}
},
{
"query_string": {
"query": "(server01\\.domain\\.com) OR (server02\\.comain\\.com)",
"default_field": "agent.hostname",
"default_operator": "AND"
}
},
{
"term": {
"log.file.path.keyword": {
"value": "/apps/myapp1/log/cssf1.log"
}
}
},
{
"query_string": {
"query": "(f1.rc:/[0]\\d{2}/ and f1.mti:/\\[1][12][13579]\\d/) "
}
},
{
"range": {"@timestamp": {"gt": "2022-04-14T15:08:50","lte": "2022-04-14T15:08:51"}}
}
]
}
}
}
}
Best Regards,
Dan