ElasticSearch Multiple condition in search query

Question

I have a requirement to build a search query with the following set of rules.

1. Get all the data which has the column / node active=true
2. Get all the data which has the column / node active=false and also which is one week old.

For instance if i have a 1000 records in a index in which there are 70% of the records having active=true and 30% of the records having active=false. Out of 30% of the records 10% is updated recently. So i need to fetch only the 80% of the records i.e 70% (active=true) + 10% (active=false).

I have tried with filter query but it's returning only the 10% of the result i.e satisfying only the Rule 2 even though i have mentioned the Rule 1 in the should block it's not accepting.

   {
  "query": {
    "bool": {
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "UpdatedOn": {
                  "gte": "now-7d/d",
                  "lte": "now/d"
                }
              }
            },
            {
              "match": {
                "Active": "false"
              }
            }
          ]
        }
      },
      "should": [
        {
          "match": {
            "Active": "true"
          }
        }
      ]
    }
  }
}

ElasticSearch Version 5.4

Thanks in advance.

Answer 1

You need to do it like this:

{
  "query": {
    "bool": {
      "minimum_should_match": 1,
      "should": [
        {
          "match": {
            "Active": "true"
          }
        },
        {
          "bool": {
            "filter": [
              {
                "range": {
                  "UpdatedOn": {
                    "gte": "now-7d/d",
                    "lte": "now/d"
                  }
                }
              },
              {
                "match": {
                  "Active": "false"
                }
              }
            ]
          }
        }
      ]
    }
  }
}