Bool query with filter giving error

Elastic Stack Elasticsearch
1

Hi,

I'm trying to run the below bool query with filter range to fetch all the
node data with CLOUD_TYPE="AWS-EC2"" and NODE_STATUS="ACTIVE".
But I'm getting SearchPhaseExecutionException from elasticsearch. Please
let me know the correct way to do this.

curl -XPOST "http://10.203.251.142:9200/aricloud/_search" -d
'{
"filtered": {
"query": {
"bool": {
"must": [
{
"term": {
"CLOUD_TYPE": "AWS-EC2"
}
},
{
"term": {
"NODE_STATUS": "ACTIVE"
}
}
]
}
},
"filter": {
"range": {
"NODE_CREATE_TIME": {
"to": "2014-03-14 18:43:55",
"from": "2014-03-14 16:22:32"
}
}
}
},
"sort": {
"NODE_ID": "desc"
},
"from": 0,
"size": 3
}'

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/4e53acd6-d68a-43fe-8340-72ae695e0060%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

You need to pass the search request a "query", so just change the above to:

GET /_search
{ "query": { "filtered": .... }, from: 0, size: 3 ...}

On 14 March 2014 14:55, Subhadip Bagui i.bagui@gmail.com wrote:

Hi,

I'm trying to run the below bool query with filter range to fetch all the
node data with CLOUD_TYPE="AWS-EC2"" and NODE_STATUS="ACTIVE".
But I'm getting SearchPhaseExecutionException from elasticsearch. Please
let me know the correct way to do this.

curl -XPOST "http://10.203.251.142:9200/aricloud/_search" -d
'{
"filtered": {
"query": {
"bool": {
"must": [
{
"term": {
"CLOUD_TYPE": "AWS-EC2"
}
},
{
"term": {
"NODE_STATUS": "ACTIVE"
}
}
]
}
},
"filter": {
"range": {
"NODE_CREATE_TIME": {
"to": "2014-03-14 18:43:55",
"from": "2014-03-14 16:22:32"
}
}
}
},
"sort": {
"NODE_ID": "desc"
},
"from": 0,
"size": 3
}'

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/4e53acd6-d68a-43fe-8340-72ae695e0060%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/4e53acd6-d68a-43fe-8340-72ae695e0060%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAPt3XKSTtR1ppgD_VopKPwXGZX3j3B_aQUMtHpeJxgA%3DX0qP3A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

Hi Clinton,

Thanks for your reply. I tried as suggested and the same is working now :slight_smile:
One question though, I have to pass the text field in lower case always as
the same is getting analyzed by standard analyzer I guess. Is there any way
to pass multiple match in bool for text search so that I can search with
part of the exact text entered, like "CLOUD" instead of "cloud"

I tried below as given in link
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl-multi-match-query.html
but it's giving error as 'Duplicate key "match" - syntax error'

POST /aricloud/_search
{
"query": {
"filtered": {
"query": {
"bool": {
"must": [
{"term": {
"CLOUD_TYPE": {
"value": "cloudstack"
}
}
}
] ,
"must_not": [
{
"term": {
"NODE_ID": {
"value": "12235"
}
}
}
],
"should": [
{
"match": {
"NODE_HOSTNAME": "cloudserver.aricent.com"
},
"match": {
"NODE_GROUP_NAME": "MYSQL"
}
}
]
}
},
"filter": {
"range": {
"NODE_CREATE_TIME": {
"from": "2014-03-14 16:32:35",
"to": "2014-03-14 18:43:55"
}
}
}
}
},
"sort": [
{
"NODE_ID": {
"order": "desc"
}
}
]
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8aac212b-018c-4f51-8222-9bb00a09377d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

4

This this instead:

{
"query": {
"filtered": {
"query": {
"bool": {
"should": [
{
"match": {
"NODE_HOSTNAME": "cloudserver.aricent.com"
}
},
{
"match": {
"NODE_GROUP_NAME": "MYSQL"
}
}
]
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"NODE_CREATE_TIME": {
"from": "2014-03-14 16:32:35",
"to": "2014-03-14 18:43:55"
}
}
},
{
"term": {
"CLOUD_TYPE": {
"value": "cloudstack"
}
}
}
],
"must_not": {
"term": {
"NODE_ID": {
"value": "12235"
}
}
}
}
}
}
},
"sort": [
{
"NODE_ID": {
"order": "desc"
}
}
]
}

Note: Your query says to match anything that contains MYSQL or
cloudserver..... Not sure if that is your intention or not

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAPt3XKSTnF7OZGpEf0ZqJ05ZmBgOY_pCy7JjEZEk5b_%3DCR21ow%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.