3

'Terms' and 'Wildcard' is provided by Elasticsearch. 'Terms' is search for multiple OR conditions:

        {
          "terms": {
           "IP": [
              "192.168.100.11",
              "192.168.100.13"
            ]
          }

'Wildcard' is recognized by the * (star):

        {
          "wildcard": {
            "IP": "192.168.*.11"
          }

I want to merge 'wildcard' + 'terms' functions. How can I do that? For example:

        {
          "wildcard": {
           "IP": [
              "192.168.*.11",
              "192.168.*.13"
            ]
          }
Dharman
  • 30,962
  • 25
  • 85
  • 135

1 Answers1

8

You can use bool's should part, I don't think there is a "terms" like query for wildcard and should behaves like an OR:

{
  "query": {
    "bool": {
      "should": [
        {"wildcard": {"IP": "192.168.*.11"}},
        {"wildcard": {"IP": "192.168.*.13"}}
      ]
    }
  }
}
Andrei Stefan
  • 51,654
  • 6
  • 98
  • 89