I get the following error when running the watcher:
"status": "failure"
"reason": "SearchPhaseExecutionException[all shards failed]; nested: QueryParsingException[bool query does not support [must-not]]; "
Would appreciate your help
Thank you,
Eric
{"watch" :
"trigger" : {
"schedule" : { "interval" : "300s" }
},
"input" : {
"search" : {
"request" : {
"indices" : [ "<logstash-{now}>", "<logstash-{now-1d}>" ],
"body" : {
"query": {
"filtered": {
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true,
"fields": [
"json.message"
]
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gt": "now-300s"
}
}
},
{
"query": {
"match": {
"attrs.label_env": {
"query": "prod"
}
}
}
},
{
"bool": {
"should": [
{
"query": {
"match": {
"json.level": {
"query": "ERROR",
"type": "phrase"
}
}
}
},
{
"query": {
"match": {
"level": {
"query": "ERR",
"type": "phrase"
}
}
}
}
]
}
}
],
"must-not": [
{
"query": {
"match": {
"json.message": {
"query": "requestID:digital-retrieve-policy-details,message:General error while calling Guidewire: 10001 - Workflow exception triggered.",
"type": "phrase"
}
}
}
}
]
}
}
}
},
"fields": [
"@timestamp",
"attrs.label_env",
"attrs.label_app",
"json.requestId",
"json.message",
"json.level"
]
}
}
}
}