弹性搜索布尔查询

Question

My objective is to find out most recent 10 documents which match message id as MSG-1013 and Severity field must be info. Both conditions should satisfied and match text should be exact. I have tried with search query below but it does not give me expected results. What am I doing wrong here ?

{
    "size": 10,
    "query": {
        "bool": { 
            "must": [
                {
                    "match": { "messageId": "MSG-1013" }
                },
                {
                    "match": { "Severity": "Info" }
                }
            ] 
        }
    }
}

Answer 1

If I have understood you correctly, you want to find the top 10 (recent) documents having exactly fields "messageId" and "Severity". I assume, you don't need a score because your score seems to be the the document timestamp or something else like a date field. For this purpose, you could use the bool filter in combination with a sort query.

{ 
    "query": {
        "bool": {
            "filter": [
                { "term": { "messageId": "MSG-1013" } },
                { "term": { "Severity": "Info" } }
            ]
        }
    },
    "sort" : [
        { "documentTimestamp" : {"order" : "desc"}}
    ],
    "size": 10
}