对于 Elasticsearch，如何在 filter->terms 查询中使用 OR 而不是 AND？

Question

I have this following query with elastic:

{
    "query": {
        "bool": {
            "filter": [{
                "terms": {
                    "participants.group": ["group1","group2"]
                }
            }, {
                "range": {
                    "recordDate": {
                        "gte": "2020-05-14 00:00:00.000",
                        "lte": "2020-07-22 20:30:56.566"
                    }
                }
            }]
        }
    }
}

Currently, this finds records with participants with group "group1" and "group2". How to change the query so it finds records with participants from "group1" or "group2?

Is it possible to do it without changing the structure of the query?

Answer 1

I'm assuming that the field participants.group is of keyword type and not text type.

Assuming that, the query you have roughly translates to (group1) or (group2) or (group1 and group2) .

All you need to do is modify the query as below and add a must_not clause like below:

POST my_filter_index/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "bool": {
              "must": [
                {
                  "range": {
                    "recordDate": {
                      "gte": "2020-05-14 00:00:00.000",
                      "lte": "2020-07-22 20:30:56.566"
                    }
                }
              }
            ], 
            "should": [
              {
                "terms": {
                  "participants.group": ["group1", "group2"]
                }
              }
            ]
          }
        }
      ], 
      "must_not": [
        {
          "bool": {
            "must": [
              {
                "term": {
                  "participants.group": "group1"
                }
              },
              {
                "term": {
                  "participants.group": "group2"
                }
              }
            ]
          }
        }
      ]
    }
  }
}

Let me know if that works!