# Search documents with specific field value in time range

**URL:** <https://discuss.elastic.co/t/search-documents-with-specific-field-value-in-time-range/217422>\
**Category:** Elasticsearch\
**Created:** [January 31, 2020, 4:19pm UTC](https://discuss.elastic.co/t/search-documents-with-specific-field-value-in-time-range/217422 "2020-01-31T16:19:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PeterH](https://avatars.discourse-cdn.com/v4/letter/p/919ad9/32.png) [@PeterH](https://discuss.elastic.co/u/PeterH)\
**Post date:** [January 31, 2020, 4:19pm UTC](https://discuss.elastic.co/t/search-documents-with-specific-field-value-in-time-range/217422/1 "2020-01-31T16:19:26Z")

</div>

I want to search all documents that have a field "logLevel" set to "WARNING" in the last 24 hours. How do I have to format this query for \_search or python elasticsearch? This is my current query:  
"query":  
{  
"term": {"logLevel": "WARNING"},  
"range": {  
"timestamp": {  
"gte": "now-1d/d",  
"lt": "now/d"  
}  
}  
}

The error message is:  
`'parsing_exception', '[term] malformed query, expected [END_OBJECT] but found [FIELD_NAME]'`

Thanks!

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 1, 2020, 4:35am UTC](https://discuss.elastic.co/t/search-documents-with-specific-field-value-in-time-range/217422/2 "2020-02-01T04:35:47Z")

</div>

You need to use a `bool` query and put your 2 clauses in the `must` array.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 29, 2020, 4:35am UTC](https://discuss.elastic.co/t/search-documents-with-specific-field-value-in-time-range/217422/3 "2020-02-29T04:35:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.