# Elasticsearch query

**URL:** <https://discuss.elastic.co/t/elasticsearch-query/288504>\
**Category:** Elasticsearch\
**Created:** [November 5, 2021, 2:35pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504 "2021-11-05T14:35:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [November 5, 2021, 2:35pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504/1 "2021-11-05T14:35:13Z")

</div>

I cannot get this query to work. Note i cannot use the Filter field  
i

```auto

GET /index-*/_search
{
  "query": {
          "term": {
        "result": "Reputation"
      },
    "range": {
      "@timestamp": {
        "gte": "now-50d",
        "lte": "now"
      }
    }

  }
}

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 8, 2021, 12:02am UTC](https://discuss.elastic.co/t/elasticsearch-query/288504/2 "2021-11-08T00:02:00Z")

</div>

You will need to provide more information please.

Why do you think it doesn't work?  
What are you expecting?  
What do your documents look like?

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [November 9, 2021, 5:57pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504/3 "2021-11-09T17:57:31Z")

</div>

I am getting this error , i am expecting documents back

```auto
{
  "error" : {
    "root_cause" : [
      {
        "type" : "parsing_exception",
        "reason" : "[terms] query does not support [rsa.misc.result]",
        "line" : 4,
        "col" : 28
      }
    ],
    "type" : "parsing_exception",
    "reason" : "[terms] query does not support [rsa.misc.result]",
    "line" : 4,
    "col" : 28
  },
  "status" : 400
}

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 9, 2021, 6:40pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504/4 "2021-11-09T18:40:39Z")

</div>

Could you provide a full recreation script as described in [About the Elasticsearch category](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script is something anyone can **copy and paste in Kibana dev console** , click on the run button to reproduce your use case. It will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

Here the query you initially shared is incorrect. You must use a bool query.  
The error message is not related by the query you shared. And it shows that your request is incorrect.

If you need help, provide details from where we can start to help.

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [November 9, 2021, 8:05pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504/5 "2021-11-09T20:05:21Z")

</div>

This works

```auto
GET /filebeat-zscaler-*/_search
{
  "query": {
      "term": {
        "rsa.misc.filter": "Botnet Callback"
      }
  }
}

```

This works

```auto

GET /filebeat-zscaler-*/_search
{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-50d",
        "lte": "now"
      }
    }
}
}

```

But this doesnt work

```auto
GET /filebeat-zscaler-*/_search
{
  "query": {
          "term": {
        "rsa.misc.filter": "Botnet Callback"
      },
    "range": {
      "@timestamp": {
        "gte": "now-50d",
        "lte": "now"
      }
    }
}
}

```

```auto

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 18, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504/6 "2021-11-18T15:06:23Z")

</div>

If you want to have multiple queries, you need to use a `bool` query. See [Boolean query | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504/7 "2021-12-16T15:06:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.