# Malformed Query?

**URL:** <https://discuss.elastic.co/t/malformed-query/120919>\
**Category:** Elasticsearch\
**Created:** [February 21, 2018, 6:59pm UTC](https://discuss.elastic.co/t/malformed-query/120919 "2018-02-21T18:59:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![liamwazherealso](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liamwazherealso/32/27868_2.png) [@liamwazherealso](https://discuss.elastic.co/u/liamwazherealso)\
**Post date:** [February 21, 2018, 6:59pm UTC](https://discuss.elastic.co/t/malformed-query/120919/1 "2018-02-21T18:59:56Z")

</div>

Hello,

I'm trying to query duplicates by comparing more than one field. I cannot use the scripting solution mentioned [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-script). So I'm using this query.

```
{
   'aggs':{
      '@timestamp':{
         'terms':{
            'field':'@timestamp'
         },
         'aggs':{
            'base_compose':{
               'terms':{
                  'field':'base_compose'
               },
               'min_doc_count':2,
               'size':0
            }
         },
         'min_doc_count':2,
         'size':0
      }
   }
}

```

I'm trying to use the solution from [this](https://stackoverflow.com/a/21302044/1325202) user. I receive a `SearchParseException` when I try and run this query.

Here's the whole error message.

```
{u'status': 400, u'error': u'SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[Ynbn8L5DTFqplqxCT8o1Wg][liam-private-test-dup][0]: RemoteTransportException[[jones-gprfs007][inet[/172.17.40.7:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[liam-private-test-dup][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"aggs": {"@timestamp": {"terms": {"field": "@timestamp"}, "aggs": {"base_compose": {"terms": {"field": "base_compose"}, "min_doc_count": 2, "size": 0}}, "min_doc_count": 2, "size": 0}}}]]]; nested: SearchParseException[[liam-private-test-dup][0]: from[-1],size[-1]: Parse Failure [Expected [START_OBJECT] under [min_doc_count], but got a [VALUE_NUMBER] in [base_compose]]]; }{[ZN6Rw0myQ5WQLLKQIwJ2uw][liam-private-test-dup][1]: RemoteTransportException[[mayo-gprfs006][inet[/172.17.40.6:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[liam-private-test-dup][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"aggs": {"@timestamp": {"terms": {"field": "@timestamp"}, "aggs": {"base_compose": {"terms": {"field": "base_compose"}, "min_doc_count": 2, "size": 0}}, "min_doc_count": 2, "size": 0}}}]]]; nested: SearchParseException[[liam-private-test-dup][1]: from[-1],size[-1]: Parse Failure [Expected [START_OBJECT] under [min_doc_count], but got a [VALUE_NUMBER] in [base_compose]]]; }{[u5HkE83LRr6OOGZ_ZJ6y3g][liam-private-test-dup][2]: RemoteTransportException[[brady-gprfs003][inet[/172.17.40.3:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[liam-private-test-dup][2]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"aggs": {"@timestamp": {"terms": {"field": "@timestamp"}, "aggs": {"base_compose": {"terms": {"field": "base_compose"}, "min_doc_count": 2, "size": 0}}, "min_doc_count": 2, "size": 0}}}]]]; nested: SearchParseException[[liam-private-test-dup][2]: from[-1],size[-1]: Parse Failure [Expected [START_OBJECT] under [min_doc_count], but got a [VALUE_NUMBER] in [base_compose]]]; }]'}
    Traceback (most recent call last)

```

I believe that this query may be malformed but I'm not sure how.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 21, 2018, 8:16pm UTC](https://discuss.elastic.co/t/malformed-query/120919/2 "2018-02-21T20:16:03Z")

</div>

The doc tells you where to put the `min_doc_count` option.  
`size:0` looks strange to me BTW.

[https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#\_minimum\_document\_count\_4](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_minimum_document_count_4)

---

<div class="post-metadata">

**Author:** ![liamwazherealso](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liamwazherealso/32/27868_2.png) [@liamwazherealso](https://discuss.elastic.co/u/liamwazherealso)\
**Post date:** [February 21, 2018, 8:34pm UTC](https://discuss.elastic.co/t/malformed-query/120919/3 "2018-02-21T20:34:51Z")

</div>

I had it on the wrong level.

Fixed now

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2018, 8:35pm UTC](https://discuss.elastic.co/t/malformed-query/120919/4 "2018-03-21T20:35:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.