This isn't a bug, but maybe the error description can be a bit clearer?
The problem is that you have two inner hits definitions in your request that use the same name. The default name is based on the type inside of the has_child query. You can provide a custom name by specifying name field inside the inner_hits definition. The inner_hit name is important here, because that is used in the response to identify to what inner_hit definition the inner hits belong to.
The following request should work:
{
"query": {
"filtered": {
"filter": {
"and": [
{
"range": {
"@timestamp": {
"gte": "2015-01-01||/d",
"lte": "2016-01-01||/d"
}
}
},
{
"or": [
{
"has_child": {
"type": "TypeName",
"filter": {
"term": {
"eventType.raw": "some-event"
}
},
"inner_hits": {
"_source": "@timestamp",
"name" : "inner_hit1"
}
}
},
{
"not": {
"has_child": {
"type": "TypeName",
"filter": {
"term": {
"eventType.raw": "some-event"
}
},
"inner_hits": {
"_source": "@timestamp",
"name" : "inner_hit2"
}
}
}
}
]
}
]
}
}
}
}