according elasticsearch doc @ http://www.elastic.co/guide/en/elasticsearch/guide/master/combining-filters.html, bool filter can following:
{ "bool" : { "must" : [ a, b ], "should" : [ c, d ], "must_not" : [ e, f ], } }
in meaning, equivalent following logic operations:
a , b , (c or d) , (not e) , (not f)
is correct?
thanks!
as andrei pointed out in comments, correct understanding bool
filter:
must
can translated(a , b)
should
can translated(c or d)
must_not
can translated((not e) , (not f))
each 1 of them operation stands alone, can combined have shown.
(a , b) , (c or d) , ((not e) , (not f))
speaking in terms of boolean logic, reason it's not same thing (not (e , f))
because same saying ((not e) or (not f))
. if e
same saying field == 5
, f
same saying field == 6
, same field != 5 or field != 6
, going true!
this leads looking @ different way:
must_not
can translated(not (e or f))
in other words, document not match if filter not match. leads simplified version of combined version:
(a , b) , (c or d) , (not (e or f))