Write one query instead of four queries

Dears,

I have a problem with write my proper query. I try to write one query which will do the same what other four queries which should:
count docs which have codes 1?? or 2?? in ci.rc
and
count docs which have codes 9?? in ci.rc
and
count docs which have codes 0?? in ci.rc and have codes 1210 or 1230 in ci.mti
and
count docs which have codes 1400 or 1420 in ci.mti

Could you advice me how to write one query which will do the same what four separate queries, please? Any advice? Please.

My skeleton of one query:

GET /log-2020.07.08/_search?size=0
{
  "query": {
    "bool": {
      "should": [
        {
          "query_string": {
            "default_field": "ci.rc",
            "query": "(1??) or (2??)"
          }
        },
        {
          "query_string": {
            "default_field": "ci.rc",
            "query": "(9??)"
          }
        },
        {
          "bool": {
            "must": [
              {
                "regexp": {
                  "ci.rc": "0[0-9]{2}"
                }
              },
              {
                "regexp": {
                  "ci.mti": "[0-9]{2}[3|5|7|9][0-9]{1}"
                }
              }
            ]
          }
        }
      ]
      }
    },
    "aggs": {
      "rc": {
        "terms": {"field": "ci.rc.keyword","size": 10}
      }
    }
  }

There is missing date condition and last separate query:
count docs which have codes 1400 or 1420 in ci.mti

Regards,
Dan

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.