Escape double quotes - query error with curl

Elastic Stack Elasticsearch
1

Hello,
I have my request below that works in Kibana DevTools that I also want to run with curl:

curl -XGET "http://localhost:9200/"index-"$(date -d "yesterday" '+%Y.%m.%d')/_search"  -H'Content-Type: application/json' -d'
 {
      "query": {
        "bool": {
          "must": [
            {
              "query_string": {
                "analyze_wildcard": true,
                "query": """field_name1: "Search" AND (field_name2:"10.165.4.3" OR field_name3:"10.165.4.4")"""
              }
            }
          ]
        }
      },
      "size": 0,
      "_source": {
        "excludes": ["_shards","hits","took","timed_out"]
      },
      "aggs": {
        "2": {
          "filters": {
            "filters": {
              "Google": {
                "query_string": {
                  "query": "field_name4:google.*",
                  "analyze_wildcard": true
                }
              },
              "Bing": {
                "query_string": {
                  "query": "field_name5:bing.*",
                  "analyze_wildcard": true
                }
              }
            }
          },
          "aggs": {
            "3": {
              "sum": {
                "field": "bytes_from_server"
              }
            }
          }
        }
      }
    }'

The problem is that with double quotes, curl send me an error for this part of my request:

"query": """field_name1: "Search" AND (field_name2:"10.165.4.3" OR field_name3:"10.165.4.4")"""

I tried several solutions proposed here https://stackoverflow.com/questions/18612248/how-to-escape-single-quotes-into-double-quotes-into-single-quotes and https://stackoverflow.com/questions/4514199/how-to-send-double-quote-in-d-parameter-for-curl-exe/15828662#15828662, which did not work.
I wanted to know how to escape these double quotes so that it works with curl or how to modify my request to have the same result without these double quotes?

thank you in advance

1 Like
2

May be try with \" ?

3

I tried this without success
"query": \"\""field_name1: "Search" AND (field_name2:"10.165.4.3" OR field_name3:"10.165.4.4")"\"\"

4

Not sure what this means: \"\""field_name1:

I'd probably write something like:

"query": "field_name1: \"Search\" AND (field_name2:\"10.165.4.3\" OR field_name3:\"10.165.4.4\")"

Or:

"query": "field_name1: """Search""" AND (field_name2:"""10.165.4.3""" OR field_name3:"""10.165.4.4""")"
5

Thank you @dadoonet it works with this syntax:
"query": "\"\"field_name1: \"Search\" AND (field_name2:\"10.165.4.3\" OR field_name3:\"10.165.4.4\")\"\""

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.