JSON queries in Kibana cause Discover: Internal Server Error

[werowe (Walker Rowe)]

I cannot execute the simplest of queries in Kibana that work just fine using curl. My understanding is that you you pick Lucene query language you can use JSON.

So this query that works from curl:

{"query":{"match":{"geoip.country_name":"Luxembourg"}}}

Causes this error when pasted into Kibana Discovery screen:

OK
Error: Internal Server Error
SearchError@http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/bundles/commons.bundle.js:3:298205
http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/bundles/commons.bundle.js:4:324937
processQueue@http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/built_assets/dlls/vendors.bundle.dll.js:427:199689
http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/built_assets/dlls/vendors.bundle.dll.js:427:200662
$digest@http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/built_assets/dlls/vendors.bundle.dll.js:427:210414
$apply@http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/built_assets/dlls/vendors.bundle.dll.js:427:213226
done@http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/built_assets/dlls/vendors.bundle.dll.js:427:132723
completeRequest@http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/built_assets/dlls/vendors.bundle.dll.js:427:136337
requestLoaded@http://ec2-35-180-186-122.eu-west-3.compute.amazonaws.com:5601/built_assets/dlls/vendors.bundle.dll.js:427:135240

[lukeelmers]

Hi @werowe,

You are correct; the query bar in Discover does accept raw query JSON when using Lucene. However, you'll just want to paste the contents of the query: {} object. (Discover doesn't support aggregations, so it is assumed that anything you put in the input is already going to be a query; best explained by this Stack Overflow answer).

Try this instead:

{"match":{"geoip.country_name":"Luxembourg"}}

Also worth noting; if you save a filter by clicking "Add Filter" in the UI, there is an option in the Edit Filter popup to manipulate the query DSL directly. In that case you could include the wrapping query: {} object.

Hope this helps!