预期格式错误的查询 END_OBJECT

Question

我是运行我的 Kibana 控制台中的以下 GET 查询，由于某种原因，我在响应 window 中收到如下错误：

{
    "error": {
        "root_cause": [
            {
                "type": "parsing_exception",
                "reason": "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
                "line": 6,
                "col": 7
            }
        ],
        "type": "parsing_exception",
        "reason": "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
        "line": 6,
        "col": 7
    },
    "status": 400
}

GET _search

{
  "query": {
    "bool": {
      "must": {              "match_phrase": {"message": "some text}}
      },
      "filter": {
    "range": {
"@timestamp":{ "time_zone": "+03:00", "lte": "now-1d/d", "gte": "now-1d/d" }
}
}
    }
  }

Answer 1

must 和 filter 都需要包含在 bool 查询中：

{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "message": "some text"
          }
        }
      ],
      "filter": [
        {
          "range": {
            "@timestamp": {
              "time_zone": "+03:00",
              "lte": "now-1d/d",
              "gte": "now-1d/d"
            }
          }
        }
      ]
    }
  }
}

顺便说一下，使用 must、filter、should 和 must_not 作为数组是个好习惯。

这样，就很容易需要新的条件和条款。最重要的是，您将拥有更清晰的查询结构，并且更难将查询组件相互混淆。

预期格式错误的查询 END_OBJECT

malformed query expected END_OBJECT

elasticsearch

kibana