Logical Query Building in MongoDB With Mongoose

Logical Query Building in MongoDB With Mongoose

Building queries with logical operators is a core skill. Here is how to do it in Mongoose.

$and: All Conditions Match

User.find({
  $and: [
    { age: { $gte: 18 } },
    { age: { $lte: 35 } },
    { gender: 'male' }
  ]
});

When you pass multiple fields in the same object, MongoDB ANDs them implicitly. Use $and explicitly only when you need the same field twice with different operators.

$or: Any Condition Matches

User.find({
  $or: [
    { email: '[email protected]' },
    { username: 'kunal' }
  ]
});

Use for "find by email OR username".

$nor: No Condition Matches

User.find({
  $nor: [
    { role: 'admin' },
    { role: 'moderator' }
  ]
});

Finds users who are neither admin nor moderator.

$not: Negate a Condition

User.find({
  age: { $not: { $gte: 18 } }
});

Finds users under 18. Same as { $lt: 18 }, but $not is useful for complex conditions.

Combining $and and $or

User.find({
  $and: [
    { status: 'active' },
    { $or: [{ age: { $lt: 18 } }, { age: { $gt: 65 } }] }
  ]
});

Active users who are under 18 or over 65.

Building Dynamic Filters

const filter = {};
if (req.query.role) filter.role = req.query.role;
if (req.query.gender) filter.gender = req.query.gender;
if (req.query.minAge || req.query.maxAge) {
  filter.age = {};
  if (req.query.minAge) filter.age.$gte = parseInt(req.query.minAge);
  if (req.query.maxAge) filter.age.$lte = parseInt(req.query.maxAge);
}
const users = await User.find(filter);

Build the filter object based on which query params are present. Pass to User.find().

Whitelist Filter Fields

Do not let users set arbitrary filter fields. Whitelist the fields they can filter by:

const allowedFilters = ['role', 'gender', 'status'];
const filter = {};
for (const key of allowedFilters) {
  if (req.query[key] !== undefined) filter[key] = req.query[key];
}

Prevents query injection and limits the surface.

The Takeaway

Build logical queries in Mongoose with $and (all match), $or (any match), $nor (none match), and $not (negate). Combine them for complex conditions. Build dynamic filters from query params. Whitelist filter fields to prevent query injection.