CODEWITHSUNDEEP
elasticsearch
laila
laila

Reputation: 1059

elasticsearch, documents with data in field1 OR field2

How do I instruct elasticsearch to return all documents which have data in one of the following fields: ['field1','field2']?

I have tried:

{
'query': {
    'bool':{
        'must':[
            'multi_match':{
                'fields':['field1','field2'],
                     'operator':'AND',
                     'tie_breaker':1.0,
                     'query': '*',
                     'type':'cross_fields'
                 }
             ]
         }
     }
}

I also tried:

{
    "query":{
        "wildcard":
            {
                 "field1":"*"
            }
        }
}

which works, but:

{
    "query":{
        "wildcard":
            {
                 "field*":"*"
            }
        }
}

does not

Upvotes: 0

Views: 290

Answers (1)

Sloan Ahrens
Sloan Ahrens

Reputation: 8718

You can do it with two exists filters in a bool filter

As an example, I set up a simple index and gave it some data:

PUT /test_index

POST /test_index/doc/_bulk
{"index":{"_id":1}}
{"field1":"foo","field2":"bar"}
{"index":{"_id":2}}
{"field2":"foo","field3":"bar"}
{"index":{"_id":3}}
{"field3":"foo","field4":"bar"}
{"index":{"_id":4}}
{"field4":"foo","field5":"bar"}

If I want to find all documents that have "field1" or "field3", I can do this:

POST /test_index/_search
{
   "query": {
      "filtered": {
         "query": {
            "match_all": {}
         },
         "filter": {
            "bool": {
               "should": [
                  { "exists": { "field": "field1" } },
                  { "exists": { "field": "field3" } }
               ]
            }
         }
      }
   }
}

It returns what I expect: 

{
   "took": 1,
   "timed_out": false,
   "_shards": {
      "total": 1,
      "successful": 1,
      "failed": 0
   },
   "hits": {
      "total": 3,
      "max_score": 1,
      "hits": [
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "1",
            "_score": 1,
            "_source": {
               "field1": "foo",
               "field2": "bar"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "2",
            "_score": 1,
            "_source": {
               "field2": "foo",
               "field3": "bar"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "3",
            "_score": 1,
            "_source": {
               "field3": "foo",
               "field4": "bar"
            }
         }
      ]
   }
}

Here's the code I used:

http://sense.qbox.io/gist/991b828de250e5125fd372bf7e6b066acec55fcd

Upvotes: 1

Related Questions