Difference between elasticsearch queries

Question

I'm having a hard time trying to figure out why these two queries do not return the same number of results (I'm using elasticsearch 2.4.1):

{
  "nested": {
    "path": "details",
    "filter": [
      { "match": { "details.id": "color" } },
      { "match": { "details.value_str": "red" } }
    ]
  }
}

{
  "nested": {
    "path": "details",
    "filter": {
      "bool": {
        "must": [
          { "match": { "details.id": "color" } },
          { "match": { "details.value_str": "red" } }
        ]
      }
    }
  }
}

The first query has more results.

My guess was that the filter clause in the first query was working like an or/should, but if I replace the must in the second query with a should, the query yields a greater number of results than that of those two.

How does the meaning of those queries differ?

I'm afraid I have no knowledge of the structure of the indexed documents; all I know is how many rows each query returns.

Answer 1

The first query is wrong, the nested filter cannot be an array, so I suspect ES doesn't parse it correctly and only takes one match instead of both, which is probably why it returns more data than the second one.

The second query is correct in terms of nested filter and yields exactly what you expect.