I am not sure if I could use nested query. Because the origin record are not typed as a nested document.

I have a recode like this:

{
"name":"Jack",
"event":[
{"jobname:job1","result:good"},
{"jobname:job2","result:bad"},
{"jobname:job3","result:soso"},
]
},
{
"name":"Andy",
"event":[
{"jobname:job1","result:bad"},
{"jobname:job2","result:bad"},
{"jobname:job3","result:good"},
]
}      
}

I am wondering how to get "jobname":"job1" and "job2:bad" in one query?

I tried:

POST index_name/_search
{
  "query": {
    "bool": {
      "filter":[ 
        {"terms":{"event.jobname":["job1"]}},
        {"terms":{"event.result":["good"]}}
      ]
    }
  }
}

And supposed to get Jack's record only. But I got Jack and Andy's record. It seems these two conditions ("jobname:job1","result:good") are not intersected.

CodePudding user response：

TLDr;

Elastic flatten objects. Such that

    {
      "group" : "fans",
      "user" : [ 
        {
          "first" : "John",
          "last" :  "Smith"
        },
        {
          "first" : "Alice",
          "last" :  "White"
        }
      ]
    }

Turn into:

    {
      "group" :        "fans",
      "user.first" : [ "alice", "john" ],
      "user.last" :  [ "smith", "white" ]
    }

You need to update your mapping to use nested field. This is going to prevent Elasticsearch from flatenning your data.