# Trying to run the query in Kibana but getting '\[bool\] malformed query, expected \[END\_OBJECT\] but found \[FIELD\_NAME\]'

**URL:** <https://discuss.elastic.co/t/trying-to-run-the-query-in-kibana-but-getting-bool-malformed-query-expected-end-object-but-found-field-name/370056>\
**Category:** Kibana\
**Created:** [November 5, 2024, 8:11am UTC](https://discuss.elastic.co/t/trying-to-run-the-query-in-kibana-but-getting-bool-malformed-query-expected-end-object-but-found-field-name/370056 "2024-11-05T08:11:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Navaneeth\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/navaneeth_k/32/138963_2.png) [@Navaneeth\_K](https://discuss.elastic.co/u/Navaneeth_K)\
**Post date:** [November 5, 2024, 8:11am UTC](https://discuss.elastic.co/t/trying-to-run-the-query-in-kibana-but-getting-bool-malformed-query-expected-end-object-but-found-field-name/370056/1 "2024-11-05T08:11:50Z")

</div>

Query used:

{  
"size": 0,  
"query": {  
"bool": {  
"must": [  
{  
"match": {  
"message": "\<API\_CALL\_NAME\>"  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-1h",  
"lte": "now"  
}  
}  
}  
]  
}  
},  
{  
"aggs": {  
"api\_calls": {  
"terms": {  
"field": "message",  
"size": 10  
}  
}  
}  
}  
}

but keep getting this error msg when i try to run in Kibana.  
Error message : [bool] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]  
Can someone pls help/clarify? Ta!

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [November 7, 2024, 3:32pm UTC](https://discuss.elastic.co/t/trying-to-run-the-query-in-kibana-but-getting-bool-malformed-query-expected-end-object-but-found-field-name/370056/2 "2024-11-07T15:32:43Z")

</div>

Hi @Navaneeth_K,

Welcome! It's difficult to say with the lack of formatting, but I think there may have been an extra brace or character somewhere. Can you try the below:

```auto
GET index/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "message": "<API_CALL_NAME>"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-1h",
              "lte": "now"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "api_calls": {
      "terms": {
        "field": "message",
        "size": 10
      }
    }
  }
}

```

Hope that helps!