Dears,
I have a problem with write my proper query. I try to write one query which will do the same what other four queries which should:
count docs which have codes 1?? or 2?? in ci.rc
and
count docs which have codes 9?? in ci.rc
and
count docs which have codes 0?? in ci.rc and have codes 1210 or 1230 in ci.mti
and
count docs which have codes 1400 or 1420 in ci.mti
Could you advice me how to write one query which will do the same what four separate queries, please? Any advice? Please.
My skeleton of one query:
GET /log-2020.07.08/_search?size=0
{
"query": {
"bool": {
"should": [
{
"query_string": {
"default_field": "ci.rc",
"query": "(1??) or (2??)"
}
},
{
"query_string": {
"default_field": "ci.rc",
"query": "(9??)"
}
},
{
"bool": {
"must": [
{
"regexp": {
"ci.rc": "0[0-9]{2}"
}
},
{
"regexp": {
"ci.mti": "[0-9]{2}[3|5|7|9][0-9]{1}"
}
}
]
}
}
]
}
},
"aggs": {
"rc": {
"terms": {"field": "ci.rc.keyword","size": 10}
}
}
}
There is missing date condition and last separate query:
count docs which have codes 1400 or 1420 in ci.mti
Regards,
Dan