Answer
The '=' and '&' characters inside the external_search value itself need to be URL-encoded, not left as literal characters — '=' becomes %3d and '&' becomes %26. So instead of writing FIELD1=VALUE1&FIELD2=VALUE2 directly, the working form is external_search=FIELD1%3dVALUE1%26FIELD2%3dVALUE2. Without this encoding, an unencoded '&' between the two conditions gets interpreted as ending the external_search parameter itself (starting a new, separate query-string parameter) rather than staying part of the combined filter, which is exactly why only whichever parameter came first in the raw string ends up applying.