# Issue on my query

**URL:** <https://discuss.elastic.co/t/issue-on-my-query/359748>\
**Category:** Elasticsearch\
**Created:** [May 18, 2024, 11:35am UTC](https://discuss.elastic.co/t/issue-on-my-query/359748 "2024-05-18T11:35:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Claudio\_Clemente](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/claudio_clemente/32/134608_2.png) [@Claudio\_Clemente](https://discuss.elastic.co/u/Claudio_Clemente)\
**Post date:** [May 18, 2024, 11:35am UTC](https://discuss.elastic.co/t/issue-on-my-query/359748/1 "2024-05-18T11:35:55Z")

</div>

I would like to aggregate the result of the rows that have the error field with the same jobid

```auto
{
  "query": {
    "match_phrase": {
      "level": "ERROR"
    },
    "exists": {
      "field": "metadata.CSBJobId"
    },
    "aggs": {
      "unique_jobsid": {
        "terms": {
          "field": "metadata.CSBJobId"
        }
      }
    }
  }
}

```

but I have this error  
[match\_phrase] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]

---

<div class="post-metadata">

**Author:** ![Hemanth\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hemanth_gowda/32/23886_2.png) [@Hemanth\_Gowda](https://discuss.elastic.co/u/Hemanth_Gowda)\
**Post date:** [May 18, 2024, 2:45pm UTC](https://discuss.elastic.co/t/issue-on-my-query/359748/2 "2024-05-18T14:45:09Z")

</div>

```auto
{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "level": "ERROR"
          }
        },
        {
          "exists": {
            "field": "metadata.CSBJobId"
          }
        }
      ]
    }
  },
    "aggs": {
      "unique_jobsid": {
        "terms": {
          "field": "metadata.CSBJobId"
        }
      }
    }
}

```

Please try using this query

---

<div class="post-metadata">

**Author:** ![Claudio\_Clemente](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/claudio_clemente/32/134608_2.png) [@Claudio\_Clemente](https://discuss.elastic.co/u/Claudio_Clemente)\
**Post date:** [May 18, 2024, 2:51pm UTC](https://discuss.elastic.co/t/issue-on-my-query/359748/3 "2024-05-18T14:51:17Z")

</div>

> [@Hemanth\_Gowda](#):
>
> ```auto
> {
> "query": {
> "bool": {
> "must": [
> {
> "match_phrase": {
> "level": "ERROR"
> }
> },
> {
> "exists": {
> "field": "metadata.CSBJobId"
> }
> }
> ]
> }
> },
> "aggs": {
> "unique_jobsid": {
> "terms": {
> "field": "metadata.CSBJobId"
> }
> }
> }
> }
> 
> ```

same error [bool] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]

---

<div class="post-metadata">

**Author:** ![Hemanth\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hemanth_gowda/32/23886_2.png) [@Hemanth\_Gowda](https://discuss.elastic.co/u/Hemanth_Gowda)\
**Post date:** [May 18, 2024, 2:53pm UTC](https://discuss.elastic.co/t/issue-on-my-query/359748/4 "2024-05-18T14:53:15Z")

</div>

Can you please paste the complete GET query?

---

<div class="post-metadata">

**Author:** ![Claudio\_Clemente](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/claudio_clemente/32/134608_2.png) [@Claudio\_Clemente](https://discuss.elastic.co/u/Claudio_Clemente)\
**Post date:** [May 18, 2024, 3:00pm UTC](https://discuss.elastic.co/t/issue-on-my-query/359748/5 "2024-05-18T15:00:10Z")

</div>

It's the one you gave me, I put it in the filter

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/4/54104c710784444f086db39394c99ac75369416c.png)

---

<div class="post-metadata">

**Author:** ![Hemanth\_Gowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hemanth_gowda/32/23886_2.png) [@Hemanth\_Gowda](https://discuss.elastic.co/u/Hemanth_Gowda)\
**Post date:** [May 18, 2024, 3:06pm UTC](https://discuss.elastic.co/t/issue-on-my-query/359748/6 "2024-05-18T15:06:00Z")

</div>

Can you please completely remove the other filters and give it a try with prova filter and let me know.

---

<div class="post-metadata">

**Author:** ![Claudio\_Clemente](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/claudio_clemente/32/134608_2.png) [@Claudio\_Clemente](https://discuss.elastic.co/u/Claudio_Clemente)\
**Post date:** [May 18, 2024, 4:09pm UTC](https://discuss.elastic.co/t/issue-on-my-query/359748/7 "2024-05-18T16:09:57Z")

</div>

the same

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/c/ec94646e86f6e72adb363c2c99ef8f96fe444463.png)