CODEWITHSUNDEEP
elasticsearchelastic-stack
Nezz
Nezz

Reputation: 55

Malformed query in Elasticsearch Watcher

I'm trying to create a watch in Elasticsearch with this conditions:

This is my body search at the moment, but it returns:

"[term] malformed query, expected [END_OBJECT] but found [FIELD_NAME]":

      "body": {
          "query": {
              "bool": {
                  "must": {
                      "range": {
                          "ht": { "lt": 100 }
                      }
                  },
                  "must_not": [{
                      "term": { "sv": "tier1" },
                      "bool": {
                          "must": [ 
                              { "term": { "sv": "tier2" } },
                              { "term": { "rv": "red" } }
                          ]
                       }
                  }],
                  "filter": {
                      "range": {
                          "timestamp": {
                              "from": "now-10m",
                              "to": "now"
                          }
                      }
                  }
               }
            }
        }

Can you help me, please? Thanks.

Upvotes: 0

Views: 514

Answers (1)

Val
Val

Reputation: 217314

The issue is in the must_not section, you need to surround each constraint with additional {...}

              "must_not": [
                  {"term": { "sv": "tier1" }},
                  {"bool": {
                      "must": [ 
                          { "term": { "sv": "tier2" } },
                          { "term": { "rv": "red" } }
                      ]
                   }}
              ],

Upvotes: 2

Related Questions