Search error on upgrade to 5.1.2

[eperry (Ed)]

Upgrading from
Kibana from 4.5.4
Upgrade to 5.1.2

I exported the search via Kibana 4.5 and imported the json file through 5.1.2 and now the search does not work. Looking for suggestions on what to fix. I don't see anything in the breaking changes for 5.0 that would explain why this breaks

In red at the top of the screen:

Discover: [parsing_exception] no [query] registered for [query], with { line=1 & col=110 }

here is the more info on the error

Error: [parsing_exception] no [query] registered for [query], with { line=1 & col=110 }
at respond (http://qa-dashboard.digital.hbc.com/kibana/bundles/kibana.bundle.js?v=14588:14:6928)
at checkRespForFailure (http://qa-dashboard.digital.hbc.com/kibana/bundles/kibana.bundle.js?v=14588:14:6156)
at http://qa-dashboard.digital.hbc.com/kibana/bundles/kibana.bundle.js?v=14588:1:23690
at processQueue (http://qa-dashboard.digital.hbc.com/kibana/bundles/commons.bundle.js?v=14588:38:23621)
at http://qa-dashboard.digital.hbc.com/kibana/bundles/commons.bundle.js?v=14588:38:23888
at Scope.$eval (http://qa-dashboard.digital.hbc.com/kibana/bundles/commons.bundle.js?v=14588:39:4619)
at Scope.$digest (http://qa-dashboard.digital.hbc.com/kibana/bundles/commons.bundle.js?v=14588:39:2359)
at Scope.$apply (http://qa-dashboard.digital.hbc.com/kibana/bundles/commons.bundle.js?v=14588:39:5037)
at done (http://qa-dashboard.digital.hbc.com/kibana/bundles/commons.bundle.js?v=14588:37:25027)
at completeRequest (http://qa-dashboard.digital.hbc.com/kibana/bundles/commons.bundle.js?v=14588:37:28702)

here is what the object looks like , when exported out of kibana (No errors on import)

[
{
"_id": "o5a-qa-account-services",
"_type": "search",
"_source": {
"title": "o5a-qa-account-services",
"description": "",
"hits": 0,
"columns": [
"correlation-id",
"service",
"level",
"msg"
],
"sort": [
"@timestamp",
"desc"
],
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{"index":"o5a_qa-","query":{"query_string":{"analyze_wildcard":true,"query":""}},"filter":[{"$state":{"store":"appState"},"bool":{"should":[{"query":{"match":{"service":{"query":"blue-martini-service","type":"phrase"}}}},{"query":{"match":{"service":{"query":"user-account-service","type":"phrase"}}}},{"query":{"match":{"service":{"query":"user-authentication-service","type":"phrase"}}}},{"query":{"match":{"service":{"query":"account-service","type":"phrase"}}}},{"query":{"match":{"service":{"query":"order-service","type":"phrase"}}}},{"query":{"match":{"service":{"query":"address-service","type":"phrase"}}}},{"query":{"match":{"service":{"query":"payment-method-service","type":"phrase"}}}}]},"meta":{"alias":null,"disabled":false,"index":"o5a_qa-","key":"bool","negate":false,"value":"{\"should\":[{\"query\":{\"match\":{\"service\":{\"query\":\"blue-martini-service\",\"type\":\"phrase\"}}}},{\"query\":{\"match\":{\"service\":{\"query\":\"user-account-service\",\"type\":\"phrase\"}}}},{\"query\":{\"match\":{\"service\":{\"query\":\"user-authentication-service\",\"type\":\"phrase\"}}}},{\"query\":{\"match\":{\"service\":{\"query\":\"account-service\",\"type\":\"phrase\"}}}},{\"query\":{\"match\":{\"service\":{\"query\":\"order-service\",\"type\":\"phrase\"}}}},{\"query\":{\"match\":{\"service\":{\"query\":\"address-service\",\"type\":\"phrase\"}}}},{\"query\":{\"match\":{\"service\":{\"query\":\"payment-method-service\",\"type\":\"phrase\"}}}}]}"}},{"$state":{"store":"appState"},"meta":{"alias":null,"disabled":false,"index":"o5a_qa-","key":"tags","negate":true,"value":"time_log"},"query":{"match":{"tags":{"query":"time_log","type":"phrase"}}}}],"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"require_field_match":false,"fragment_size":2147483647}}"
}
}
}
]

[Marius_Dragomir]

My guess is that this might have something to do with the changes to the queries in 5.x
https://www.elastic.co/guide/en/elasticsearch/reference/current/breaking_50_search_changes.html
Easiest way to see what's changed (because that's a very big list there) is to recreate the query in 5.x and compare the two exported objects.

[eperry (Ed)]

yah it seems the issue is with the "Filter" but don't understand what is wrong with it , I'll try to recreate it but we have a lot of pages with filters, I would hate to have to fix ever single one.

There should not have been breaking changes between a 5.1 and 5.2 release. Deprecated sure but not removed. it has me really annoyed.

[Marius_Dragomir]

That's the list of breaking changes between 4.x and 5.y not between 5.1 and 5.2. That's the situation that I got from your initial post.

[Bargs (Matt Bargar)]

The issue is specifically with the custom bool filter you have. Each sub-query of the bool starts with a query object, which is no longer valid. You'll need to remove the query wrapper around each sub query so it looks like the syntax here https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html.

We do this transformation automatically on filters created via the UI but we can't do it for custom filters.

[eperry (Ed)]

yah sort of been coming to that solution, been helping another internal app with a broken query fix a similar issue related to his queries.

I will see about testing this out tomorrow and will let you know.

THANKS!

Oh yah it was between 4.5 -> 5.2 I had another issue with Sort going from 5.1 to 5.2 got the issues confused. Have to get back to the solution for why my sort statement is broken. but I need to read about that before I raise the question to the community