# Timestamp range with aggregation query

**URL:** https://discuss.elastic.co/t/timestamp-range-with-aggregation-query/85089
**Category:** Elasticsearch
**Created:** [May 9, 2017, 12:39pm UTC](https://discuss.elastic.co/t/timestamp-range-with-aggregation-query/85089 "2017-05-09T12:39:44Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)
#### Post date: [May 9, 2017, 12:39pm UTC](https://discuss.elastic.co/t/timestamp-range-with-aggregation-query/85089/1 "2017-05-09T12:39:44Z")

</div>

I am trying to get top 5 IP between certain time range with the below query. But it is not working.  
Please tell me what is the problem with query and how to fix it?

```
    {
      "size":0,
      "query": {
        "bool": {
          "must_not": [
            {"match": { "client_ip": "10.107. **.**" }}
          ]
        },
        "range" : {
          "timestamp" : {
              "gte": "2017-03-25 00:00:00", 
              "lte": "now"
          }
        }
      },
      "aggs":{
          "top-terms-aggregation":{  
             "terms":{  
                "field":"client_ip.keyword",
                "size":5
             }
          }
       }
    }

```

I am getting this error,

```
{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
        "line": 10,
        "col": 5
      }
    ],
    "type": "parsing_exception",
    "reason": "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
    "line": 10,
    "col": 5
  },
  "status": 400
}

```

Thank you.

---

<div class="post-metadata">

### Author: ![lwintergerst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lwintergerst/32/18164_2.png) [@lwintergerst](https://discuss.elastic.co/u/lwintergerst)
#### Post date: [May 9, 2017, 2:37pm UTC](https://discuss.elastic.co/t/timestamp-range-with-aggregation-query/85089/2 "2017-05-09T14:37:23Z")

</div>

Hey Saurabh,  
if you want to combine multiple queries - in your case a match and a range query - you will have to use the bool query. You did that sucessfully for the must\_not, the only thing you are missing is to also move the range query in a "must". This is how the working query looks like. Note that the only thing that I changed is to move the "range" in a "must":

> ```
> {
> "size": 0,
> "query": {
> "bool": {
> "must_not": [
> {
> "match": {
> "client_ip": "10.107. **.**"
> }
> }
> ],
> "must": [
> {
> "range": {
> "timestamp": {
> "gte": "2017-03-25 00:00:00",
> "lte": "now"
> }
> }
> }
> ]
> }
> },
> "aggs": {
> "top-terms-aggregation": {
> "terms": {
> "field": "client_ip.keyword",
> "size": 5
> }
> }
> }
> }
> 
> ```

---

<div class="post-metadata">

### Author: ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)
#### Post date: [May 10, 2017, 4:56am UTC](https://discuss.elastic.co/t/timestamp-range-with-aggregation-query/85089/3 "2017-05-10T04:56:13Z")

</div>

Thank you very much.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 7, 2017, 5:05am UTC](https://discuss.elastic.co/t/timestamp-range-with-aggregation-query/85089/4 "2017-06-07T05:05:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.