[PHP] expected [END_OBJECT] but got [FIELD_NAME], possibly too many query clauses

Elastic Stack Elasticsearch
1

Elasticsearch 2.4.5
PHP 7.0

I have the following aggregation query that works via curl but fails when I convert to PHP. I feel like I'm missing something stupid/easy and just looking for another set of eyes

curl -XPOST "http://localhost:9200/_search" -d '
{
  "size": 1,
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": [
            {"type": { "value": "web_logs" }},
            {"range": {
              "@timestamp": {
                "gte": "2017-10-01T00:00:00.000" ,
                "lt": "2017-11-01T00:00:00.000"
              }
            }}
          ]
        }
      }
    }
  },
  "aggs": {
    "by_company": {
      "terms": {
        "field": "company.raw"
      },
      "aggs": {
        "total_bytes": {
          "sum": {
            "field": "sc_bytes"
          }
        }
      }
    }
  }
}'

But when I try to convert it to PHP I get an error

<?php
ini_set('display_errors', 0);

use Elasticsearch\ClientBuilder;

require 'vendor/autoload.php';

$hosts = [
  'localhost:9200'
];


$client = ClientBuilder::create()
  ->setHosts($hosts)
  ->build();

$params['body'] = [
  'size' => 1,
  'query' => [
    'filtered' => [
      'filter' => [
        'bool' => [
          'must' => [
            'type' => [
              'value' => 'web_logs'
            ],
            'range' => [
              '@timestamp' => [
                'gte' => '2017-10-01T00:00:00.000',
                'lt' => '2017-11-01T00:00:00.000'
              ]
            ]
          ],
        ]
      ]
    ]
  ],
  'aggs' => [
    'by_company' => [
      'terms' => [
        'field' => 'company.raw'
      ],
      'aggs' => [
        'total_bytes' => [
          'sum' => [
            'field' => 'sc_bytes'
          ]
        ]
      ]
    ]
  ]
];

$results = $client->search($params);

Here is the error

$ php report2.php
PHP Fatal error:  Uncaught Elasticsearch\Common\Exceptions\BadRequest400Exception: {"error":{"root_cause":[{"type":"query_parsing_exception","reason":"expected [END_OBJECT] but got [FIELD_NAME], possibly too many query clauses","index":"logstash-2017.09.11","line":1,"col":92},{"type":"query_parsing_exception","reason":"expected [END_OBJECT] but got [FIELD_NAME], possibly too many query clauses","index":"logstash-2017.09.12","line":1,"col":92},{"type":"query_parsing_exception","reason":"expected [END_OBJECT] but got [FIELD_NAME], possibly too many query clauses","index":"logstash-2017.09.13","line":1,"col":92},{"type":"query_parsing_exception","reason":"expected [END_OBJECT] but got [FIELD_NAME], possibly too many query clauses","index":"logstash-2017.09.14","line":1,"col":92},{"type":"query_parsing_exception","reason":"expected [END_OBJECT] but got [FIELD_NAME], possibly too many query clauses","index":"logstash-2017.09.15","line":1,"col":92},{"type":"query_parsing_exception","reason":"expected [END_OBJECT] but got [FIELD_NAME in /mnt/c/Users/Chris/code/logstash/vendor/elasticsearch/elasticsearch/src/Elasticsearch/Connections/Connection.php on line 610
2

You probably figured it out by now, but just in case, you are missing [ ] around queries in the must clause.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.