CODEWITHSUNDEEP
elasticsearchkibanadsl
yuliansen
yuliansen

Reputation: 520

query return [parsing_exception] [size] query malformed, no start_object after query name, with { line=1 & col=264 }

I'm new in elasticsearch, and i try to use dev tools to create filters. here is what work and I want to use

POST /transform_alldomain/_search
{
  "size":0,
    "aggs": {
        "group": {
            "terms": {
                "field": "Email.keyword"
            },
            "aggs": {
        "group": {
            "terms": {
                "field": "bln.keyword"
            },
            "aggs": {
                "group_docs": {
                    "top_hits": {
                        "size": 1,
                        "sort": [
                            {
                                "extract_date.max": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                }
            }
        }
    }
}
}}

now i want to use this similiar stuff to filter as type this into filter, edit as query dsl

{
  "size":0,
    "aggs": {
        "group": {
            "terms": {
                "field": "Email.keyword"
            },
            "aggs": {
        "group": {
            "terms": {
                "field": "bln.keyword"
            },
            "aggs": {
                "group_docs": {
                    "top_hits": {
                        "size": 1,
                        "sort": [
                            {
                                "extract_date.max": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                }
            }
        }
    }
}
}}

it returns

[parsing_exception] [size] query malformed, no start_object after query name, with { line=1 & col=324 }

I don't know what is the difference and how to make it work

I need to create searched object from this

How I execute the filter:

enter image description here

it returns

enter image description here

Upvotes: 0

Views: 966

Answers (1)

Val
Val

Reputation: 217304

The Discover app is not the right tool to use to make aggregations, the Discover app is only useful for queries and filters.

What you want to achieve can be done with a Data table visualization. So instead of Discover, go to Visualize, then pick "Create Visualization"

Create Visualization

Then pick the "Data Table" Visualization

Data Table

Then pick your index pattern

Index pattern

And finally you can define your two terms aggregations like this:

Terms aggregations

Upvotes: 1

Related Questions