Hi,
I attempt save a search template with a term query.
POST _scripts/test-json
{
"script": {
"lang": "mustache",
"source": {"query": {"filter": {"bool": {"must": [{"terms": {"beat.hostname": {{#tojson}}hostname{{/tojson}} } }] } } } }
}
}
But I got a syntax error without the double quote.
I saw the issue in github.
https://github.com/elastic/elasticsearch/issues/21648
I changed the template like the sample in the issue, it's no syntax error. But I can not get the result.
POST _scripts/test-json
{
"script": {
"lang": "mustache",
"source": {"query": {"filter": {"bool": {"must": [{"terms": {"beat.hostname": ["{{hostname}}"] } }] } } } }
}
}
And then I changed the template:
POST _scripts/test-json
{
"script": {
"lang": "mustache",
"source": {"query": {"filter": {"bool": {"must": [{"terms": {"beat.hostname": ["{{#tojson}}hostname{{/tojson}}}}"] } }] } } } }
}
}
After call is, I got a runtime error.
{
"type": "json_parse_exception",
"reason": "Unexpected character ('h' (code 104)): was expecting comma to separate Array entries\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@396f6738; line: 1, column: 190]"
}
How could I use the terms in a pre-registered template?
Thank you.