elasticsearch, documents with data in field1 OR field2 - elasticsearch

Question

How do I instruct elasticsearch to return all documents which have data in one of the following fields: ['field1','field2']?
I have tried:
{
'query': {
'bool':{
'must':[
'multi_match':{
'fields':['field1','field2'],
'operator':'AND',
'tie_breaker':1.0,
'query': '*',
'type':'cross_fields'
}
]
}
}
}
I also tried:
{
"query":{
"wildcard":
{
"field1":"*"
}
}
}
which works, but:
{
"query":{
"wildcard":
{
"field*":"*"
}
}
}
does not

Answer 1

You can do it with two exists filters in a bool filter
As an example, I set up a simple index and gave it some data:
PUT /test_index
POST /test_index/doc/_bulk
{"index":{"_id":1}}
{"field1":"foo","field2":"bar"}
{"index":{"_id":2}}
{"field2":"foo","field3":"bar"}
{"index":{"_id":3}}
{"field3":"foo","field4":"bar"}
{"index":{"_id":4}}
{"field4":"foo","field5":"bar"}
If I want to find all documents that have "field1" or "field3", I can do this:
POST /test_index/_search
{
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"bool": {
"should": [
{ "exists": { "field": "field1" } },
{ "exists": { "field": "field3" } }
]
}
}
}
}
}
It returns what I expect:
{
"took": 1,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"failed": 0
},
"hits": {
"total": 3,
"max_score": 1,
"hits": [
{
"_index": "test_index",
"_type": "doc",
"_id": "1",
"_score": 1,
"_source": {
"field1": "foo",
"field2": "bar"
}
},
{
"_index": "test_index",
"_type": "doc",
"_id": "2",
"_score": 1,
"_source": {
"field2": "foo",
"field3": "bar"
}
},
{
"_index": "test_index",
"_type": "doc",
"_id": "3",
"_score": 1,
"_source": {
"field3": "foo",
"field4": "bar"
}
}
]
}
}
Here's the code I used:
http://sense.qbox.io/gist/991b828de250e5125fd372bf7e6b066acec55fcd