sample with raw query

[starlessboi]

Hi thanks for you amazing job I have a use case that need to export data with a given raw query like this: { "query": { "query_string": { "query": "source : x.x.x.x " } }, "fields": [ "@timestamp", "source.address", "user.id" ], "_source": false } ' how can I do this? can you give a sample? thanks in advance

[ggsongnail]

you can try like this elastic-query-export -r '{"bool":{"must":[],"filter":[{"bool":{"should":[{"match_phrase":{"message":"屈臣氏"}}],"minimum_should_match":1}}],"should":[],"must_not":[]}}'