I have json data as follows
{
"_index": "project",
"_type": "ts_order_snapshot",
"_id": "1",
"_version": 1,
"exists": true,
"_source": {
"order_id": "100000001",
"order_data": "Order Data:{\"entity_id\":\"1\",\"state\":\"canceled\"}"
}
}
Now I would like to get the list of all the order ids having state as canceled. Any suggestions?