Unknown key for a START_ARRAY in [query]

Elastic Stack Elasticsearch
1

My GET request is returning an error response to my query. Can't figure out what's wrong with my DSL.

Error:

{
"error": {
    "root_cause": [
        {
            "type": "parsing_exception",
            "reason": "Unknown key for a START_ARRAY in [query].",
            "line": 11,
            "col": 14
        }
    ],
    "type": "parsing_exception",
    "reason": "Unknown key for a START_ARRAY in [query].",
    "line": 11,
    "col": 14
},
"status": 400

}

Query:

{
"size": 1,
"sort": [
    {
        "@timestamp": {
            "unmapped_type": "boolean",
            "order": "desc"
        }
    }
],
"query": [
    {
        "query_string": {
            "query": "\"context.request.body.event.type\": 7",
            "analyze_wildcard": true
        },
        "bool": {
            "filter": [
                {
                    "range": {
                        "@timestamp": {
                            "gte": "now-20m"
                        }
                    }
                }
            ]
        }
    }
]

}

2

The query can't be an array. You must write it like:

{
  "query": {
    // One query here
  }
}

So put the query_string query within the bool query under a must clause.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.