# Elasticsearch update by query

**URL:** <https://discuss.elastic.co/t/elasticsearch-update-by-query/247709>\
**Category:** Elasticsearch\
**Created:** [September 7, 2020, 6:23am UTC](https://discuss.elastic.co/t/elasticsearch-update-by-query/247709 "2020-09-07T06:23:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mohammad\_Mousavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohammad_mousavi/32/56508_2.png) [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\
**Post date:** [September 7, 2020, 6:23am UTC](https://discuss.elastic.co/t/elasticsearch-update-by-query/247709/1 "2020-09-07T06:23:43Z")

</div>

Hi, This is my code:

```
POST /logstash-myapp-*/_update_by_query
  {
  "query": {
   "term" : {
     "tags.keyword" : "myapp-stream"
           },
"bool": {
  "filter": [
    {
      "match": {
        "response": "200"
      }
    },
    {
      "match": {
        "response": "206"
      }
    }
  ]
    },
  "match": {
        "request": { "query": "*.ts"}
         }
  }
},
    "script": {
    "inline": "ctx._source.ts_duration = 9",
    "lang": "painless"
  }
}

```

and i got this error:

```
{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
        "line": 1,
        "col": 89
      }
    ],
    "type": "parsing_exception",
    "reason": "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
    "line": 1,
    "col": 89
  },
  "status": 400
}

```

What's the problem ?  
Thanx  
and also ehere should I add time range if I want ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2020, 6:23am UTC](https://discuss.elastic.co/t/elasticsearch-update-by-query/247709/2 "2020-10-05T06:23:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.