# Elasticsearch search query

**URL:** <https://discuss.elastic.co/t/elasticsearch-search-query/83230>\
**Category:** Elasticsearch\
**Created:** [April 21, 2017, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query/83230 "2017-04-21T15:44:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![khaoulaari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khaoulaari/32/24288_2.png) [@khaoulaari](https://discuss.elastic.co/u/khaoulaari)\
**Post date:** [April 21, 2017, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query/83230/1 "2017-04-21T15:44:27Z")

</div>

hello everyone i'm new on Es and i'm trying to run the following code

# 

function getClusters() {  
es\_client.search({  
index: settings.cluster.index,  
type: 'metrics',  
body: {  
query: {  
bool: {  
must: [  
{  
range: {  
timestamp: {  
gte: moment().utc().subtract(14, 'days').valueOf(),  
lte: moment().utc().valueOf()  
}  
}  
}  
]  
}  
},  
aggs: {  
clusters: {  
terms: {  
field: "cluster",  
size: settings.cluster.max  
}  
}  
}  
}  
so i get the following error 🙁

```
{true
phase
:
"query"
reason
:
"all shards failed"
root_cause
:
[{type: "illegal_argument_exception",…}]
0
:
{type: "illegal_argument_exception",…}
reason
:
"Fielddata is disabled on text fields by default. Set fielddata=true on [cluster] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory."
type
:
"illegal_argument_exception"
type
:
"search_phase_execution_exception"
status
:
400

```

i added this "fielddata": true, after metrics but it doesnt work , anyone have an idea plz ?  
ps i'm using ES 5.3.0

---

<div class="post-metadata">

**Author:** ![shanec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shanec/32/4004_2.png) [@shanec](https://discuss.elastic.co/u/shanec)\
**Post date:** [April 21, 2017, 9:47pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query/83230/2 "2017-04-21T21:47:47Z")

</div>

There are 2 different types of string-like data: `text` and `keyword`. There _used_ to only be `string`, but in 5.0, this was split into these 2 separate types. I recommend you should check out the blog on this at [https://www.elastic.co/blog/strings-are-dead-long-live-strings](https://www.elastic.co/blog/strings-are-dead-long-live-strings) since it underlies what you're running into. As you'll see in that blog, if you're using the old `string` mapping, you may actually have 2 fields, whether you realize it or not: a `cluster` field _and_ a `cluster.keyword` field which Elasticsearch may have created for you implicitly.

So after you get through that blog, you may know what you want to do. The most likely answer is that you want to do your terms agg on a keyword data (e.g. `cluster.keyword`) instead of the text field `cluster`. However, if you're sure you want to use the text field instead, you'll need to add `fielddata` set to `true` in the mapping for the `cluster` field. You can see everything you need to know about doing that at (which, again, I'd recommend reading the whole page) [https://www.elastic.co/guide/en/elasticsearch/reference/5.3/fielddata.html#\_fielddata\_is\_disabled\_on\_literal\_text\_literal\_fields\_by\_default](https://www.elastic.co/guide/en/elasticsearch/reference/5.3/fielddata.html#_fielddata_is_disabled_on_literal_text_literal_fields_by_default)

---

<div class="post-metadata">

**Author:** ![khaoulaari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khaoulaari/32/24288_2.png) [@khaoulaari](https://discuss.elastic.co/u/khaoulaari)\
**Post date:** [April 24, 2017, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query/83230/3 "2017-04-24T13:57:02Z")

</div>

Thank you for your answer , I’ve read the two documents it helped me a lot to understand the changes on ES5.3 so i added this to my mapping's configuration  
I read the two documents

> ```
> > "my_type": {
> > "properties": {
> > "cluster": {
> > "type": "text",
> > "fielddata": true,
> > "fields": {
> > "keyword": {
> > "type": "keyword"
> > }
> > }
> > }
> > }
> > }
> 
> ```

and i called the fields by \> cluster.keyword but it send a \> null value with the same message error  
request's response :  
`{"query":{"bool":{"must":[{"range":{"timestamp":{"gte":1492780567038,"lte":1493039767038}}},{"term":{"cluster":null}}]}}}:`

```
es_client.search({
    index: 'inviso-cluster',
    type: type,
    body: {
      query: {
        bool: {
          must: [
            { range: { timestamp: { gte: start, lte: stop }}},
            { term: { 'cluster': cluster }}
          ]
        }
      }
    }

```

is it a problem about the security connection ?

---

<div class="post-metadata">

**Author:** ![shanec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shanec/32/4004_2.png) [@shanec](https://discuss.elastic.co/u/shanec)\
**Post date:** [April 24, 2017, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query/83230/4 "2017-04-24T15:53:04Z")

</div>

I don't quite understand what you're asking. Can you maybe rephrase?

---

<div class="post-metadata">

**Author:** ![khaoulaari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khaoulaari/32/24288_2.png) [@khaoulaari](https://discuss.elastic.co/u/khaoulaari)\
**Post date:** [April 26, 2017, 11:51am UTC](https://discuss.elastic.co/t/elasticsearch-search-query/83230/5 "2017-04-26T11:51:58Z")

</div>

Your proposal solved the problem, the other error was due to field timestamps which I replaced after by a function that calculates it because it is not supported on ES 5.3

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2017, 12:04pm UTC](https://discuss.elastic.co/t/elasticsearch-search-query/83230/6 "2017-05-24T12:04:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.