Kibana-4.5.0 Query DSL Not working in Discover search bar

Elastic Stack Kibana
1

Hi
I am using kibana version 4.5.0, elastic search 2.3.1 version and getting the following exception while trying to excuting the below query from Discover tab search bar.

Query1 used :
{

"query": {
"match_all": {}
},
"fields" : ["userid", "username"]
}

Exception for Query1 in Kibana UI :

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"query_parsing_exception","reason":"[filtered] query does not support [query]","index":"logserver","line":1,"col":145}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logserver","node":"aRE-5393Q2W9ls2xkTTSUg","reason":{"type":"query_parsing_exception","reason":"[filtered] query does not support [query]","index":"logserver","line":1,"col":145}}]}}

Query2 used :

{
"query" : {
"match_all": {}
},
"aggs" : {
"countSize": {
"avg" : { "field" : "NUM_RECORDS" }
}
}
}

Exception for Query2 in Kibana UI :

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"query_parsing_exception","reason":"No query registered for [aggs]","index":"logserver","line":1,"col":110}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logserver","node":"aRE-5393Q2W9ls2xkTTSUg","reason":{"type":"query_parsing_exception","reason":"No query registered for [aggs]","index":"logserver","line":1,"col":110}}]}}

But the same query is working fine when called via elasticsearch REST API and returns the expected result. Please let me know if any settings need to be enabled in kibana or elasticsearch

2

The querybar only allows you to specify the query.filtered.query.query_string parameter, like so:

"query": {
  "filtered": {
    "query": {
      "query_string": {
        "query": "<QUERYBAR INPUT HERE>",
        "analyze_wildcard": true
      }
    },
  }
}

Or if you use JSON, query.filtered.query, like so:

"query": {
  "filtered": {
    "query": {
      <QUERYBAR JSON HERE>
    }
  }
}

The reason you are seeing errors is because, once you put that query JSON in there, the resulting query is no longer valid, since it's ending up in query.filtered.query.