Multi Search Query SQL API

Elastic Stack Elasticsearch
1

Hi,

I'm trying to send more than one sql query in the same request, but I'm having problems. I'm testing this request in Dev Tools:

POST _xpack/sql?format=csv

{"query":"SELECT sourceIp, count(log_message) AS Derrota FROM \"customer-token-*\" WHERE sourceIp = '216.151.184.121' AND (log_message LIKE '%Nao foi possivel autenticar%' OR log_message LIKE '%O numero maximo de tentativas%') GROUP BY sourceIp"}
{"query":"SELECT sourceIp, count(log_message) AS Sucesso FROM \"customer-token-*\" WHERE sourceIp = '216.151.184.121' AND (log_message NOT LIKE '%Nao foi possivel autenticar%' AND log_message NOT LIKE '%O numero maximo de tentativas%') GROUP BY sourceIp"}

And I'm getting the following error:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "parse_exception",
        "reason" : "request body or source parameter is required"
      }
    ],
    "type" : "parse_exception",
    "reason" : "request body or source parameter is required"
  },
  "status" : 400
}
2

That's not a supported feature, you'd need to run (in this case) two separate queries, either sequentially, or in parallel. Or, alternatively, since your SELECT targets and GROUPing are the same, merge the two WHEREs with an OR in a single statement.

3

Thank you @bogdan.pintea , got the expected result.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.