I’m working on searching employees details based on multiple values for a given field i.e. will pass multiple employee email address/names and also multiple countries for a given request. Now, we need to pull the required details of those employees (based on name, email address and their respective country).

Query works fine with single field value search like an employee name or employee email address, country and a date range. But, it fails to get required response with multiple values for employee name or email address, countries and a date range.

Below is index mapping details :

{
emplsampleindex: {
    mappings: {
        employeeinfo: {
        properties: {
            emp_cntry: { type: "keyword" },
            employee_name: { type: "text",
                 fields: { keyword: { type: "keyword" } } },
            email_address: { type: "keyword"},
            hiredate: { type: "date", format: "yyyy-MM-dd" }
          }
        }
        }
    }
}

Working with single value :

 {
      "bool" : {
        "must" : [
          {
            "match" : {
              "email_address" : {
                "query" : "[email protected]",
                "operator" : "OR",
                "prefix_length" : 0,
                "max_expansions" : 50,
                "fuzzy_transpositions" : true,
                "lenient" : false,
                "zero_terms_query" : "NONE",
                "auto_generate_synonyms_phrase_query" : true,
                "boost" : 1.0
              }
            }
          }
        ],
        "filter" : [
          {
            "range" : {
              "hiredate" : {
                "from" : "2013-08-01",
                "to" : null,
                "boost" : 1.0
              }
            }
          }
        ],
        "adjust_pure_negative" : true,
        "boost" : 1.0
      }
    }

Not Working with multiple value : :

{
  "bool": {
    "filter": [
      {
        "range": {
          "hiredate": {
            "from": "2013-08-01",
            "to": null,
            "boost": 1.0
          }
        }
      }
    ],
    "should": [
      {
        "term": {
          "email_address": {
            "value": "[email protected]",
            "boost": 1.0
          }
        }
      },
      {
        "term": {
          "email_address": {
            "value": "[email protected]",
            "boost": 1.0
          }
        }
      }
    ],
    "adjust_pure_negative": true,
    "boost": 1.0
  }
}

With should, we are getting all employee records from 2013-08-01 in elasticsearch and instead of should, if I use must then we are not getting any result i.e. total hits though we have records for those email_address.

3