The msearch request must be terminated by a newline


I've been stuck on this problem

Basically I have a curl POST request that works when it's written directly on a terminal, but whenever I try to do it in a script, I get this error

$data_string = '{"index":["tracker"],"ignore_unavailable":true,"preference":1533127804501}{"size":0,"_source":{"excludes":[]},"aggs":{"2":{"terms":{"field":"","size":500,"order":{"_count":"desc"}},"aggs":{"3":{"terms":{"field":"trackerType.keyword","size":50,"order":{"_count":"desc"}}}}}},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["date"],"query":{"bool":{"must":[{"match_all":{}},{"range":{"date":{"gte":1533041405943,"lte":1533127805943,"format":"epoch_millis"}}}],"filter":[],"should":[],"must_not":[]}}}';

I've tried putting newlines everywhere (first at the logic places, then I slowly became paranoid about everything and re-evaluated my existence)

But I still end up with this error

{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"The msearch request must be terminated by a newline [\n]"}],"type":"illegal_argument_exception","reason":"The msearch request must be terminated by a newline [\n]"},"status":400}

Please send help


it is impossible to take a look at the request you actually sent to elasticsearch, so this is super hard to debug. The error message says, that the last character of your msearch body should be a new line. Is this the case?



I actually had it working this morning, all I did (even tho I'm pretty sure I've tried that yesterday) is add two \n in the json request

$data_string = '{"index":["tracker"],"ignore_unavailable":true,"preference":1533127804501}'."\n".'{"size":0,"_source":{"excludes":[]},"aggs":{"2":{"terms":{"field":"","size":500,"order":{"_count":"desc"}},"aggs":{"3":{"terms":{"field":"trackerType.keyword","size":50,"order":{"_count":"desc"}}}}}},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["date"],"query":{"bool":{"must":[{"match_all":{}},{"range":{"date":{"gte":'.$newRapport.',"lte":'.($newRapport += 86400000).',"format":"epoch_millis"}}}],"filter":[],"should":[],"must_not":[]}}}'."\n";

Elastic search sure has a strange formatting

Same reasons the Post Office expect you to put letters in envelopes - they're quicker to sort and distribute if the distributor only deals with the routing information and they don't have to parse the details of the letter contents.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.