What to do with query inside filter query

Elastic Stack Elasticsearch
1

Hi, people from Elasticsearch.

I have struggles trying to migrate to Elasticsearch 7.11.1 from very old Elasticsearch 1.3.

"The original query" below is used in our codebase to be executed against Elasticsearch 1.3 and it used to be working fine.

After switching to Elasticsearch 7.11.1, we got an error that "filtered" query is deprecated and fixed it by replacing "filtered" with "bool" query which turned into "The fixed query".

Now we got an error of "unknown query [query]" when we executing the "The fixed query". Please see the "The error response" at the bottom for details.

I'm new to Elasticsearch, so not sure how should I fix this.

Please tell me how should I fix this to make the query work against the Elasticsearch 7.11.1.

The original query:

curl -H 'content-type: application/json' http://elasticsearch:9200/ticket-status/_search -d '
{
    "query": {
        "filtered": {
            "filter": {
                "and": [
                    {
                        "term": {
                            "_appId": "1"
                        }
                    },
                    {
                        "range": {
                            "@timestamp": {
                                "from": "1641222000",
                                "to": "1643986799"
                            }
                        }
                    },
                    {
                        "query": {
                            "query_string": {
                                "default_field": "_ticketContent",
                                "query": ""
                            }
                        }
                    }
                ]
            }
        }
    },
    "size": 0,
    "aggs": {
        "uu_heat_ticket_histogram": {
            "date_histogram": {
                "field": "_logTime",
                "time_zone": "Asia/Tokyo",
                "interval": "day"
            },
            "aggs": {
                "distinct_customers": {
                    "terms": {
                        "field": "_customerId",
                        "size": 0
                    }
                }
            }
        }
    }
}'

The fixed query:

curl -H 'content-type: application/json' http://elasticsearch:9200/ticket-status/_search -d '
{
    "query": {
        "bool": {
            "filter": [
                {
                    "term": {
                        "_appId": "1"
                    }
                },
                {
                    "range": {
                        "@timestamp": {
                            "from": "1641222000",
                            "to": "1643986799"
                        }
                    }
                },
                {
                    "query": { πŸ‘ˆ this caused an error
                        "query_string": {
                            "default_field": "_ticketContent",
                            "query": ""
                        }
                    }
                }
            ]
        }
    },
    "size": 10000,
    "aggs": {
        "uu_heat_ticket_histogram": {
            "date_histogram": {
                "field": "_logTime",
                "time_zone": "Asia/Tokyo",
                "calendar_interval": "day"
            },
            "aggs": {
                "distinct_customers": {
                    "terms": {
                        "field": "_customerId",
                        "size": 10000
                    }
                }
            }
        }
    }
}'

The error response:

{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "unknown query [query]",
        "line": 20,
        "col": 30
      }
    ],
    "type": "x_content_parse_exception",
    "reason": "[20:30] [bool] failed to parse field [filter]",
    "caused_by": {
      "type": "parsing_exception",
      "reason": "unknown query [query]",
      "line": 20,
      "col": 30,
      "caused_by": {
        "type": "named_object_not_found_exception",
        "reason": "[20:30] unknown field [query]"
      }
    }
  },
  "status": 400
}
2

put "query_string" object out from query object and put it directly in the filter array just as other term, range queries.

1 Like
3

@Tomo_M
Thanks for the help! Let me see if this works.

4

@Tomo_M
γ‚γ‚ŠγŒγ¨γ†γ”γ–γ„γΎγ™οΌ

it worked. :100:

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.