I am trying to have this query in elasticsearch statement:

(ip=xx.xx.xx.xx and status="running") or (ip=xx.xx.xx.xx and status="running")

can anyone tell me how can i write this in elasticsearch query.

CodePudding user response：

Read about Bool Queries

Try this query:

{
  "query": {
    "bool": {
      "minimum_should_match": 1, 
      "should": [
        {
          "bool": {
            "must": [
              {
                "term": {
                  "ip": {
                    "value": "xx.xx.xx.xx"
                  }
                }
              },
              {
                "term": {
                  "status": {
                    "value": "running"
                  }
                }
              }
            ]
          }
        },
         {
          "bool": {
            "must": [
              {
                "term": {
                  "ip": {
                    "value": "bb.bb.bb.bb"
                  }
                }
              },
              {
                "term": {
                  "status": {
                    "value": "running"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}