# Query Syntax question

**URL:** <https://discuss.elastic.co/t/query-syntax-question/102728>\
**Category:** Elasticsearch\
**Created:** [October 4, 2017, 3:34pm UTC](https://discuss.elastic.co/t/query-syntax-question/102728 "2017-10-04T15:34:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajay\_bh111](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@ajay\_bh111](https://discuss.elastic.co/u/ajay_bh111)\
**Post date:** [October 4, 2017, 3:34pm UTC](https://discuss.elastic.co/t/query-syntax-question/102728/1 "2017-10-04T15:34:58Z")

</div>

I have index with following info as seen in Kibana query json:  
{  
"\_index": "es5dbmon\_10",  
"\_type": "metrics",  
"\_id": "AV7nxxU3nLFmflBF65oY",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"@timestamp": "2017-10-04T14:26:00Z",  
"disk": {  
"free": 20491194368,  
"inodes\_free": 5224658,  
"inodes\_total": 5242880,  
"inodes\_used": 18222,  
"total": 84415266816,  
"used": 63048323072,  
"used\_percent": 75.47125600442061  
},  
"measurement\_name": "disk",  
"tag": {  
"device": "sda",  
"fstype": "ext4",  
"host": "esdbmonm05",  
"path": "/es1"  
}  
},  
"fields": {  
"@timestamp": [  
1507127160000  
]  
},  
"highlight": {  
"measurement\_name": [  
"@kibana-highlighted-field@disk@/kibana-highlighted-field@"  
],  
"tag.path": [  
"/@kibana-highlighted-field@es1@/kibana-highlighted-field@"  
]  
},  
"sort": [  
1507127160000  
]  
}

When I try to query the same info using Python client script (ES version 5.5) with the highlighted term line , output is displayed and data retrieved looks OK. But when I uncomment the highlighted line { "term": { "tag.path": "/es1" }}, it gives parsing error like below:  
What is not correct/syntax in adding the second condition for path matching in query ?

Error:

./test.py  
Traceback (most recent call last):  
File "./test.py", line 22, in   
{ "term": { "tag" : {"path": "/es1" }}}  
File "/usr/local/lib/python2.7/dist-packages/elasticsearch/client/utils.py", line 73, in \_wrapped  
return func(\*args, params=params, \*\*kwargs)  
File "/usr/local/lib/python2.7/dist-packages/elasticsearch/client/ **init**.py", line 569, in search  
doc\_type, '\_search'), params=params, body=body)  
File "/usr/local/lib/python2.7/dist-packages/elasticsearch/transport.py", line 318, in perform\_request  
status, headers, data = connection.perform\_request(method, url, params, body, ignore=ignore, timeout=timeout)  
File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http\_urllib3.py", line 128, in perform\_request  
self.\_raise\_error(response.status, raw\_data)  
File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/base.py", line 122, in \_raise\_error  
raise HTTP\_EXCEPTIONS.get(status\_code, TransportError)(status\_code, error\_message, additional\_info)  
**elasticsearch.exceptions.RequestError: TransportError(400, u'parsing\_exception', u'[term] query does not support [path]')**

Script:

!/usr/bin/env python  
import requests  
from elasticsearch import Elasticsearch  
import json  
import time  
import signal  
from subprocess import call  
DISK\_PATH="TBD"  
DISK\_USED=0  
HOST="localhost"  
es = Elasticsearch([{'host': 'localhost', 'port': 80}])  
while True:  
res = es.search(  
index="es5dbmon\*",  
doc\_type="metrics",  
body={"query": {  
"bool": {  
"must": [  
{ "term": { "measurement\_name": "disk" }},  
**# { "term": { "tag.path": "/es1" }}**  
]  
}  
}  
}  
)  
print("%d documents found" % res['hits']['total'])  
for doc in res['hits']['hits']:  
HOST=doc['\_source']['tag']['host']  
DISK\_PATH=doc['\_source']['tag']['path']  
DISK\_USED=doc['\_source']['disk']['used\_percent']  
print ('DISK Usage %: ' + str(DISK\_PATH) + " "+ str(DISK\_USED) +" "+ str(doc['\_source']['@timestamp']))

output shows like below:

195283 documents found  
DISK Usage %: /es1 73.8076888944 2017-10-01T05:14:00Z  
DISK Usage %: /es1 52.4002237761 2017-10-01T05:13:00Z

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2017, 3:35pm UTC](https://discuss.elastic.co/t/query-syntax-question/102728/2 "2017-11-01T15:35:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.