# Query parse error

**URL:** https://discuss.elastic.co/t/query-parse-error/45485
**Category:** Elasticsearch
**Created:** [March 25, 2016, 9:56pm UTC](https://discuss.elastic.co/t/query-parse-error/45485 "2016-03-25T21:56:25Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![voipoclay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/voipoclay/32/4372_2.png) [@voipoclay](https://discuss.elastic.co/u/voipoclay)
#### Post date: [March 25, 2016, 9:56pm UTC](https://discuss.elastic.co/t/query-parse-error/45485/1 "2016-03-25T21:56:25Z")

</div>

I was wondering why one query works and other doesnt. The top one gives me a parse error.

does not work:

```
{
	"query": {
		"filtered": {
			"query": {
				"query_string": {
					"query": "*",
					"analyze_wildcard": true
				}
			},
			"filter": {
				"bool": {
					"must": {
						"0": {
							"range": {
								"@timestamp": {
									"gte": "now-30d/d",
									"lte": "now",
									"format": "yyyy-MM-dd HH:mm:ss"
								}
							}
						}
					}
				}
			}
		}
	}
}

```

Works:

```
{
	"query": {
		"filtered": {
			"query": {
				"query_string": {
					"query": "*",
					"analyze_wildcard": true
				}
			},
			"filter": {
				"bool": {
					"must": [{
						"range": {
							"@timestamp": {
								"gte": "now-30d/d",
								"lte": "now",
								"format": "yyyy-MM-dd HH:mm:ss"
							}
						}
					}]
				}
			}
		}
	}
}
```

---

<div class="post-metadata">

### Author: ![Glen\_Smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/glen_smith/32/111656_2.png) [@Glen\_Smith](https://discuss.elastic.co/u/Glen_Smith)
#### Post date: [March 25, 2016, 10:15pm UTC](https://discuss.elastic.co/t/query-parse-error/45485/2 "2016-03-25T22:15:23Z")

</div>

Clay,

The first query is malformed.

What does the parse error say?

Glen

---

<div class="post-metadata">

### Author: ![voipoclay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/voipoclay/32/4372_2.png) [@voipoclay](https://discuss.elastic.co/u/voipoclay)
#### Post date: [March 26, 2016, 12:06am UTC](https://discuss.elastic.co/t/query-parse-error/45485/3 "2016-03-26T00:06:22Z")

</div>

> [@Glen\_Smith](#):
>
> Clay,
> 
> The first query is malformed.
> 
> What does the parse error say?

```
{
   "error": {
      "root_cause": [
         {
            "type": "query_parsing_exception",
            "reason": "No query registered for [0]",
            "index": "channelhangup2-2016.03.10",
            "line": 13,
            "col": 19
         }
  }
}

```

A bunch of times for each index over the range. Shouldn't ES just strip out the "0" ?

---

<div class="post-metadata">

### Author: ![Glen\_Smith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/glen_smith/32/111656_2.png) [@Glen\_Smith](https://discuss.elastic.co/u/Glen_Smith)
#### Post date: [March 26, 2016, 12:53am UTC](https://discuss.elastic.co/t/query-parse-error/45485/4 "2016-03-26T00:53:47Z")

</div>

Clay,

No. That's not a valid construction of a must clause. You should use the one that works.

Glen

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:05pm UTC](https://discuss.elastic.co/t/query-parse-error/45485/5 "2017-07-05T23:05:02Z")

</div>


