sql - How to properly implement boolean logic -
i'm using elasticsearch logging within application. need write log viewer filters on fields of document.
my documents this:
"_source": { "timestamp": 1373502012000, "userid": 6, "paid": 56331, "lid": 6, "prid": 2, "vid": 6336, "actiontype": "load_data" } actiontype enum (java).
i need write elasticsearch equivalent following sql query:
select * snapshot.action_log_item timestamp between 1372718783286 , 1372718783286 , userid=6 , paid=56331 , lid=6 , prid=2 , vid=6336 , ( actiontype='load_data' or actiontype='save_data' or actiontype='log_in' ); please me write nested query and/or filter result equivalent sql statement.
edit here's current code (that works without { "or"... portion).
{ "query" : { "bool" : { "must" : [ { "term" : { "userid" : 6 } }, { "term" : { "lid" : 6 } }, { "term" : { "vid" : 6336 } } ] } }, "filter" : { "and" : { "filters" : [ { "term" : { "paid" : 56331 } }, { "range" : { "timestamp" : { "from" : 1372718783286, "to" : 1377643583286, "include_lower" : true, "include_upper" : true } } }, { "or" : { "filters" : [ { "term" : { "actiontype" : "load_data" } }, { "term" : { "actiontype" : "save_data" } }, { "term" : { "actiontype" : "log_in" } } ] } } ] } } } edit: following query works. it's not same query above, returns expected result. seems these filters/queries don't work on actiontype field.
{ "size": 30, "query": { "filtered": { "query": { "bool": { "must": [ { "term": { "uid": 6 } }, { "term": { "loid": 6 } }, { "term": { "prid": 2 } }, { "terms": { "paid": [ 56331, 56298 ], "minimum_should_match": 1 } } ] } }, "filter": { "range": { "timestamp": { "from": 1372718783286, "to": 1377643583286, "include_lower": true, "include_upper": true } } } } } }
the {or... portion should this:
{ "or": [ { "term": { "actiontype": "load_data" } }, { "term": { "actiontype": "save_data" } }, { "term": { "actiontype": "log_in" } } ] } you can check doc filter here
edit
as see having problems rewrote query. hope helps
{ "query": { "filtered": { "query": { "bool": { "must": [ { "term": { "userid": 6 } }, { "term": { "paid": 56331 } }, { "term": { "lid": 6 } }, { "term": { "prid": 2 } }, { "term": { "vid": 6336 } }, { "terms": { "actiontype": [ "load_data", "save_data", "log_in" ], "minimum_should_match": 1 } } ] } }, "filter": { "range": { "timestamp": { "from": 1372718783286, "to": 1377643583286, "include_lower": true, "include_upper": true } } } } } } basically put date range filter , other conditions term queries inside must clause of boolean query. can see or part inside must clause terms query act or between 3 values.
Comments
Post a Comment