# Exists syntax placement with change

**URL:** <https://discuss.elastic.co/t/exists-syntax-placement-with-change/94535>\
**Category:** Elasticsearch\
**Created:** [July 25, 2017, 8:03pm UTC](https://discuss.elastic.co/t/exists-syntax-placement-with-change/94535 "2017-07-25T20:03:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dodegaard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dodegaard/32/18177_2.png) [@dodegaard](https://discuss.elastic.co/u/dodegaard)\
**Post date:** [July 25, 2017, 8:03pm UTC](https://discuss.elastic.co/t/exists-syntax-placement-with-change/94535/1 "2017-07-25T20:03:21Z")

</div>

I am trying to query for a date range where a particular field exists. This seems like it would be easy but I am sensing that the keyword "exists" has changed per the documentation. I am on 5.4. I use @timestamp for dates and the field "error\_data" is in the mapping and only appears if an error condition is found.

Here is my query....

```
GET /filebeat-2017.07.25/_search
{
    "query": {
        "bool" : {
          "filter" : {
            "range" : {
                "@timestamp" : {
                    "gte" : "now-5m",
                    "lte" : "now-1m"
                }
            }
          },
          "exists": {
          "field": "error_data"
          }
        }
    }
}

```

but it says that "[bool] query does not support [exists]" whereas the following does not work either but gets an parsing error message of "[exists] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]" on line 6 column 9. Thanks for your help.

```
GET /filebeat-2017.07.25/_search
{
    "query": {
        "exists": {
          "field": "error_data"
        }, 
        "bool" : {
          "filter" : {
            "range" : {
                "@timestamp" : {
                    "gte" : "now-5m",
                    "lte" : "now-1m"
                }
            }
          }
        }
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2017, 8:03pm UTC](https://discuss.elastic.co/t/exists-syntax-placement-with-change/94535/2 "2017-08-22T20:03:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.