I have a field in Kibana called test. How can I write a DSL query that finds documents where the value for test is either "one two three" or "four five six"?

CodePudding user response：

You can use the bool/should clause with the match_phrase query

{
    "query": {
        "bool": {
            "should": [
                {
                    "match_phrase": {
                        "test": "one two three"
                    }
                },
                {
                    "match_phrase": {
                        "test": "four five six"
                    }
                }
            ]
        }
    }
}

OR you can use terms query on the test.keyword field

{
    "query": {
        "terms": {
            "test.keyword": [
                "one two three",
                "four five six"
            ]
        }
    }
}