elasticsearch - elasticsearch必须查询结合OR？

Question

我一直在尝试对bool使用must查询，但是无法获取结果。

在伪SQL中:

SELECT * FROM info WHERE (ulevel= '1.3.10' or ulevel= '1.3.6') AND (@timestamp between '2017-06-05T07:00:00.000Z' and '2017-06-05T07:00:00.000Z')

这是我所拥有的:

"query": {
    "bool": {
        "must": [
            {
                 "query_string": {
                        "default_field": "_all",
                        "query": "*"
                                    },
                 "range": {
                         "@timestamp": {
                               "from": "2017-06-05T07:00:00.000Z",
                               "to": "2017-06-05T07:20:00.000Z"
                                        }
                     },
                "bool": {
                    "should": [
                        {"term": { "ulevel": "1.3.10"}},
                         {"term": { "ulevel": "1.3.6"}}
                             ]
                       }
            }
        ]
    }
  }

有没有人有办法解决吗？

非常感谢。

Answer 1

您可以将terms查询用于第一部分，将范围查询用于第二部分

GET _search
{
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "ulevel": [
              "1.3.10",
              "1.3.6"
            ]
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2017-06-05T07:00:00.000Z",
              "lte": "2017-06-05T07:20:00.000Z"
            }
          }
        }
      ]
    }
  },
  "from": 0,
  "size": 20
}

Some Notes :

1. Filters documents that have fields that match any of the provided terms (not analyzed)
2. Also you can use some date spesific formulation with rage filter. Please check the range query page https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates more information.

更新:

为评论问题添加了 from和 size。