Error with filtered, date ranged, search query

Elastic Stack Elasticsearch
1

Hi,

Elastic (2.4) is unhappy with this search query, from the docs it looks approx right, any pointers gratefully received :slight_smile:

{
   "query":{
      "query_string":{
         "query":"news",
         "default_operator":"AND"
      },
      "filtered":{
         "filter":{
            "bool":{
               "must":[
                  {
                     "term":{
                        "status":"published"
                     }
                  },
                  {
                     "term":{
                        "include_in_search":1
                     }
                  },
                  {
                     "missing":{
                        "field":"deleted"
                     }
                  }
               ]
            }
         }
      },
      "constant_score":{
         "filter":{
            "range":{
               "published":{
                  "gte":"now"
               }
            }
         }
      }
   },
   "sort":{
      "TraceDateTime":{
         "order":"desc",
         "ignore_unmapped":"true"
      }
   }
}

The error is:

{
   "error":{
      "root_cause":[
         {
            "type":"parse_exception",
            "reason":"failed to parse search source. expected field name but got [START_OBJECT]"
         }
      ],
      "type":"search_phase_execution_exception",
      "reason":"all shards failed",
      "phase":"query",
      "grouped":true,
      "failed_shards":[
         {
            "shard":0,
            "index":"XXX",
            "node":"j4ZKPe3HQ5Scet4uSd4QGg",
            "reason":{
               "type":"parse_exception",
               "reason":"failed to parse search source. expected field name but got [START_OBJECT]"
            }
         }
      ]
   },
   "status":400
}

Thanks,

Jon

2

Please format your code using </> icon as explained in this guide. It will make your post more readable.

Or use markdown style like:

```
CODE
```
3

Apologies, the editor consistently messes with newlines etc though :frowning:

4

That's better but to make it readable, could you indent the code properly? You can use https://jsonformatter.curiousconcept.com/ for example.

Thanks

5

Hi,

I use VSCODE, the text I paste in is a being reformatted terribly by Discuss' editor, it starts off perfectly.

Here's request/response in a pastebin: https://paste.ee/p/ys8MV (which annoyingly swapped the order on render).

Thanks.

6

Hmm. I see. There have been recently some changes in the discuss editor which indeed formats badly the text if you "paste" code.
But it's ok if you "paste with style" (on mac it's image ).

I edited your post.

7

I think the problem is here:

"sort":{
      "TraceDateTime":{
         "order":"desc",
         "ignore_unmapped":"true"
      }
   }

Can you try with:

"sort":[{
      "TraceDateTime":{
         "order":"desc",
         "ignore_unmapped":"true"
      }
   }]
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.