I upgraded to Elasticsearch 5.2 and this query no longer works:
POST _search
{
"size":3000,
"query":{
"filtered":{
"query":{
"range":{
"@timestamp":{"gt":"now-2m", "lte":"now"}
}
},
"filter":{
"or":[
{"term":{"severity":"ERROR"}},
{"term":{"severity":"FATAL"}}
]
}
}
}
}
It resulted in this error:
{"error":{"root_cause":[{"type":"parsing_exception","reason":"no [query] registered for [filtered]","line":1,"col":42}],"type":"parsing_exception","reason":"no [query] registered for [filtered]","line":1,"col":42},"status":400}
After switching to using bool and must and leaving the filter or I got this error:
{"error":{"root_cause":[{"type":"parsing_exception","reason":"[or] query malformed, no start_object after query name","line":1,"col":168}],"type":"parsing_exception","reason":"[or] query malformed, no start_object after query name","line":1,"col":168},"status":400}
I thought this would work, but it's returning no results when it should:
POST _search
{
"size":3000,
"query":{
"bool":{
"must":{
"range":{
"@timestamp":{"gt":"now-2m", "lte":"now"}
}
},
"should":[
{"term":{"severity":"ERROR"}},
{"term":{"severity":"FATAL"}}
],
"minimum_should_match": 1
}
}
}
What am I missing?