Help... Query JSON Input filter


#1

Hi all,

In a Tile Map visualization, I want to exclude a specific ip from the graph.
I try to create a JSON Input filter:

{
"size": 0,
"query": {
"filtered": {
"query": {
"query_string": {
"query": "",
"analyze_wildcard": true
}
},
"filter": {
"bool": {
"must_not": [
{
"term": {
"geoip.ip": "x.x.x.x"
}
}
]
}
}
}
}
}

But I have an error:
Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"search_parse_exception","reason":"Unexpected token VALUE_BOOLEAN in [2].","line":1,"col":364}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logstash-201601011200","node":"GCR-klVjTISVdBELonhgUQ","reason":{"type":"search_parse_exception","reason":"Unexpected token VALUE_BOOLEAN in [2].","line":1,"col":364}}]}}

I don't know how to solve this problem.

Many thanks for your help.


(Mark Walkom) #2

A boolean query requires either true or false, so that is not valid.

What version of things are you on?


(system) #3