Issue on my query

[Claudio_Clemente]

I would like to aggregate the result of the rows that have the error field with the same jobid

{
  "query": {
    "match_phrase": {
      "level": "ERROR"
    },
    "exists": {
      "field": "metadata.CSBJobId"
    },
    "aggs": {
      "unique_jobsid": {
        "terms": {
          "field": "metadata.CSBJobId"
        }
      }
    }
  }
}

but I have this error
[match_phrase] malformed query, expected [END_OBJECT] but found [FIELD_NAME]

[Hemanth_Gowda]

{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "level": "ERROR"
          }
        },
        {
          "exists": {
            "field": "metadata.CSBJobId"
          }
        }
      ]
    }
  },
    "aggs": {
      "unique_jobsid": {
        "terms": {
          "field": "metadata.CSBJobId"
        }
      }
    }
}

Please try using this query

[Claudio_Clemente]

@Hemanth_Gowda

{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "level": "ERROR"
          }
        },
        {
          "exists": {
            "field": "metadata.CSBJobId"
          }
        }
      ]
    }
  },
    "aggs": {
      "unique_jobsid": {
        "terms": {
          "field": "metadata.CSBJobId"
        }
      }
    }
}

same error [bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]

[Hemanth_Gowda]

Can you please paste the complete GET query?

[Claudio_Clemente]

It's the one you gave me, I put it in the filter

[Hemanth_Gowda]

Can you please completely remove the other filters and give it a try with prova filter and let me know.

[Claudio_Clemente]

the same