Exists syntax placement with change

Elastic Stack Elasticsearch
1

I am trying to query for a date range where a particular field exists. This seems like it would be easy but I am sensing that the keyword "exists" has changed per the documentation. I am on 5.4. I use @timestamp for dates and the field "error_data" is in the mapping and only appears if an error condition is found.

Here is my query....

GET /filebeat-2017.07.25/_search
{
    "query": {
        "bool" : {
          "filter" : {
            "range" : {
                "@timestamp" : {
                    "gte" : "now-5m",
                    "lte" : "now-1m"
                }
            }
          },
          "exists": {
          "field": "error_data"
          }
        }
    }
}

but it says that "[bool] query does not support [exists]" whereas the following does not work either but gets an parsing error message of "[exists] malformed query, expected [END_OBJECT] but found [FIELD_NAME]" on line 6 column 9. Thanks for your help.

GET /filebeat-2017.07.25/_search
{
    "query": {
        "exists": {
          "field": "error_data"
        }, 
        "bool" : {
          "filter" : {
            "range" : {
                "@timestamp" : {
                    "gte" : "now-5m",
                    "lte" : "now-1m"
                }
            }
          }
        }
    }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.