CODEWITHSUNDEEP
elasticsearch
Mehrdad
Mehrdad

Reputation: 583

problem with elasticsearch query, range malformed query, expected END_OBJECT but found FIELD_NAME

I cant figure out what's wrong with this query. Both "range" and "exists" work independently, but together I get parsing expection and range malformed query, expected END_OBJECT but found FIELD_NAME. Can someone figure out what's wrong with this query?

{
"query": {
  "range":{
     "@timestamp":{
        "gte":"2019-08-04T11:00:00",
        "lt":"2019-10-04T12:00:00"
     }
  },
  "exists": {
      "field": "params.zone"
  }  

},
"_source": ["@timestamp", "params.zone"]
}

Upvotes: 5

Views: 3442

Answers (1)

Mysterion
Mysterion

Reputation: 9320

If you want to combine several queries like you're doing with range and exists you need to use bool query and decided which of your clauses are mandatory (must), optional (should), filter (filter), or shouldn't be presented in results (must_not)

Query which would work could look like this (you're clauses are mandatory in this example):

{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": "2019-08-04T11:00:00",
              "lt": "2019-10-04T12:00:00"
            }
          }
        },
        {
          "exists": {
            "field": "params.zone"
          }
        }
      ]
    }
  },
  "_source": [
    "@timestamp",
    "params.zone"
  ]
}

Upvotes: 10

Related Questions