This search will not work:
index=mail and (scriptName=ACF or scriptName=ACE)
This search will work:
index=mail AND (scriptName=ACF OR scriptName=ACE)
That is true. AND is not and. But i thing here you don't need to use the AND because index=mail (scriptName=ACF OR scriptName=ACE)
is the same with index=mail AND (scriptName=ACF OR scriptName=ACE)
Also, when you say index=mail and (scriptName=ACF OR scriptName=ACE)
, this match all events where index= mail and that events must have the word and and then the sourcetype must be ACF or the scriptNAME must be ACE
But when you say index=mail (scriptName=ACF OR scriptName=ACE)
, this match all events where the index= mail, and sourcetype= ACF or sriptName=ACF
Thanks