elasticsearch boolean search syntax

Question

Can anybody please explain why this elasticsearch syntax is incorrect. I'm struggling to get my head around basic syntaxing

This works

"query": {
    "filtered": {
        "filter": {
           "bool" : {
               "should": {
                   "terms": {
                       "headline":["aut"]
                   }                        
               },
               "must": {
                    "range": {
                        "date_at" : {
                           "gt": "1900-01-01 00:00:00",
                           "lt": "1980-01-01 00:00:00"
                        }
                    }                       
               }
           }
        }
    }
}

However, this query doesn't work

"query": {
    "filtered": {
        "filter": {
           "bool" : {
               "should": {
                   "terms": {
                       "headline":["aut"]
                   }                        
               },
               "must": {
                    "range": {
                        "date_at" : {
                           "gt": "1900-01-01 00:00:00",
                           "lt": "1980-01-01 00:00:00"
                        }
                    },
                    "term": {
                        "headline": "et" 
                    }
               }
           }
        }
    }
}

The addition of the "term" clause inside the boolean "must" is causing a syntax error, all shards broken etc... The issue appears to be I want to use the same index twice inside two different bools specifically

headline MUST contain "foo"

headline SHOULD contain "bar"

Is it possible?

Answer 1

Have you tried this?

{
   "query": {
      "filtered": {
         "filter": {
            "bool": {
               "should": [
                  {
                     "terms": {
                        "headline": [
                           "aut"
                        ]
                     }
                  }
               ],
               "must": [
                  {
                     "range": {
                        "date_at": {
                           "gt": "1900-01-01 00:00:00",
                           "lt": "1980-01-01 00:00:00"
                        }
                     }
                  },
                  {
                     "term": {
                        "headline": "et"
                     }
                  }
               ]
            }
         }
      }
   }
}

That would be the direct interpretation of what you're trying to do, but this is probably what you actually need:

{
   "query": {
      "filtered": {
         "filter": {
            "bool": {
               "must": [
                  {
                     "range": {
                        "date_at": {
                           "gt": "1900-01-01 00:00:00",
                           "lt": "1980-01-01 00:00:00"
                        }
                     }
                  },
                  {
                     "term": {
                        "headline": "et"
                     }
                  }
               ]
            }
         }
      }
   }
}

Here is some code I used to play around with it:

http://sense.qbox.io/gist/ea16ff321397c2187ef503541019d52c564b7460