How to perform AND condition in elasticsearch query?

Question

I have the following query where I want to query the indexname for ID "abc_12-def that fall within the date range specified in the range filter.

But the below query is fetching values of different ID as well(for eg: abc_12-edf, abc_12-pgf etc) and that fall outside the date range. Any advice on how I can give an AND condition here? Thanks.

curl -XPOST 'localhost:9200/indexname/status/_search?pretty=1&size=1000000' -d '{
"query": {
"filtered" : {
  "filter": [ 
    { "term":  { "ID": "abc_12-def" }}, 
    { "range": { "Date": { "gte": "2015-10-01T09:12:11", "lte" : "2015-11-18T10:10:13" }}} 
  ]
  }
  }
  }'

Check the mappings using `GET /index_name/type_name/_mapping` and specify in question. — Richa, Apr 01 '16 at 06:58
Please share the mapping in question. By default all string fields are `analyzed` — Richa, Apr 01 '16 at 16:57
This is the mapping for that particular field: ID":{"type":"string"} — Sweet, Apr 02 '16 at 03:42
If no analyzer is mentioned, strings are `analyzed` by default. So, your ID field is `analyzed` — Richa, Apr 02 '16 at 04:13

score 0 · Answer 1 · edited May 23 '17 at 12:15

You need to use Bool query for AND aka MUST condition

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "ID": "abc_12-def"
          }
        },
        {
          "range": {
            "Date": {
              "gte": "2015-10-01T09:12:11",
              "lte": "2015-11-18T10:10:13"
            }
          }
        }
      ]
    }
  }
}

Also, all fields by default are analyzed using standard analyzer, which means abc_12-def is tokenized as [abc_12, def]. term query does not analyze the string.

If you are looking for an exact match, you should mark the field as not_analyzed. How to map it as not_analyzed is explained here.

How to perform AND condition in elasticsearch query?

1 Answers1