Malformed Query?

Elastic Stack Elasticsearch
1

Hello,

I'm trying to query duplicates by comparing more than one field. I cannot use the scripting solution mentioned here. So I'm using this query.

{
   'aggs':{
      '@timestamp':{
         'terms':{
            'field':'@timestamp'
         },
         'aggs':{
            'base_compose':{
               'terms':{
                  'field':'base_compose'
               },
               'min_doc_count':2,
               'size':0
            }
         },
         'min_doc_count':2,
         'size':0
      }
   }
}

I'm trying to use the solution from this user. I receive a SearchParseException when I try and run this query.

Here's the whole error message.

{u'status': 400, u'error': u'SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[Ynbn8L5DTFqplqxCT8o1Wg][liam-private-test-dup][0]: RemoteTransportException[[jones-gprfs007][inet[/172.17.40.7:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[liam-private-test-dup][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"aggs": {"@timestamp": {"terms": {"field": "@timestamp"}, "aggs": {"base_compose": {"terms": {"field": "base_compose"}, "min_doc_count": 2, "size": 0}}, "min_doc_count": 2, "size": 0}}}]]]; nested: SearchParseException[[liam-private-test-dup][0]: from[-1],size[-1]: Parse Failure [Expected [START_OBJECT] under [min_doc_count], but got a [VALUE_NUMBER] in [base_compose]]]; }{[ZN6Rw0myQ5WQLLKQIwJ2uw][liam-private-test-dup][1]: RemoteTransportException[[mayo-gprfs006][inet[/172.17.40.6:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[liam-private-test-dup][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"aggs": {"@timestamp": {"terms": {"field": "@timestamp"}, "aggs": {"base_compose": {"terms": {"field": "base_compose"}, "min_doc_count": 2, "size": 0}}, "min_doc_count": 2, "size": 0}}}]]]; nested: SearchParseException[[liam-private-test-dup][1]: from[-1],size[-1]: Parse     Failure [Expected [START_OBJECT] under [min_doc_count], but got a [VALUE_NUMBER] in [base_compose]]]; }{[u5HkE83LRr6OOGZ_ZJ6y3g][liam-private-test-dup][2]: RemoteTransportException[[brady-gprfs003][inet[/172.17.40.3:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[liam-private-test-dup][2]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"aggs": {"@timestamp": {"terms": {"field": "@timestamp"}, "aggs": {"base_compose": {"terms": {"field": "base_compose"}, "min_doc_count": 2, "size": 0}}, "min_doc_count": 2, "size": 0}}}]]]; nested: SearchParseException[[liam-private-test-dup][2]: from[-1],size[-1]: Parse Failure [Expected [START_OBJECT] under [min_doc_count], but got a [VALUE_NUMBER] in [base_compose]]]; }]'}
    Traceback (most recent call last)

I believe that this query may be malformed but I'm not sure how.

2

The doc tells you where to put the min_doc_count option.
size:0 looks strange to me BTW.

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_minimum_document_count_4

3

I had it on the wrong level.

Fixed now

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.