bool 格式错误的查询，预计 END_OBJECT 但发现 FIELD_NAME 无法查询 _search

Question

所以我正在尝试 post 将此查询转换为 elastic 并出现标题中的错误。这是我的参考查询：

{
            "query": {
                "bool": {
                    "filter": [ { 
                        "match_phrase": { 
                            "doc_type": "commits" 
                        } 
                        },
                        { 
                        "range": {
                            "@timestamp": { 
                                "gte": start_date + "T00:00:00+00:00", 
                                "lte": end_date + "T00:00:00+00:00" 
                            }
                        }
                    }
                    ],
                    "should": 
                    {
                        "match_phrase": {"field1": "string"}
                    },
                    "minimum_should_match": 1,
                    "must_not":
                    {
                        "match_phrase": {"repository_name": "repo_name"}
                    }
            },
            "size": 0,
            "aggs": {
                "repo_name": {
                "terms": {
                    "field": "repository_full_name",
                    "size": 10000
                },
                "aggs": {
                    "repo_name": {
                    "terms": {
                        "field": "BRANCH_NAME",
                        "size": 10000
                    }
                    }
                }
                }
            }
            }
        }    

我想了解为什么出现此错误？我已经仔细检查了所有括号是否正确闭合，无法绞尽脑汁。

Answer 1

您在查询部分末尾缺少一个 }。在开始聚合部分之前，应该关闭查询部分。 结构应该是 -

{
  "query":{},
  "aggs":{}
}

试试下面的查询

{
  "query": {
    "bool": {
      "filter": [
        {
          "match_phrase": {
            "doc_type": "commits"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": start_date + "T00:00:00+00:00",
              "lte": end_date + "T00:00:00+00:00"
            }
          }
        }
      ],
      "should": {
        "match_phrase": {
          "field1": "string"
        }
      },
      "minimum_should_match": 1,
      "must_not": {
        "match_phrase": {
          "repository_name": "repo_name"
        }
      }
    }
  },                             // note this
  "size": 0,
  "aggs": {
    "repo_name": {
      "terms": {
        "field": "repository_full_name",
        "size": 10000
      },
      "aggs": {
        "repo_name": {
          "terms": {
            "field": "BRANCH_NAME",
            "size": 10000
          }
        }
      }
    }
  }
}