How achieve a conjunction (AND operator) in a JSON nested Key-value(KV) array

[T0n1g3]

Event Data:
{"Debug":[
  {"Action":"User-Created","Result":"OK"},
  {"Action":"Granted-Permissions","Result":"Failed"}
]}

My try:
# Get the events where Action equal "User-Created" and Result="Failed"
Search: index=index_name Debug{}.Action="User-Created" AND Debug{}.Result="Failed"

Expected:
No records should be returned because there are not a single record where the two values are true.

Result:
Multiple records returned, conjunction is not being performed, it operates like an OR logical function.

Notes:
It works if I choose simple not KV data.

Thanks,

[ITWhisperer]

The filter on the search is returning events that have both strings. Both strings appear in your event.

You either have to include the whole string (escaping double quotes as necessary) "\"User-Created\",\"Result\":\"Failed\"" or you have to mvexpand (or similar) the Debug array into separate events and then filter those events.