Elasticsearch - EXISTS syntax + Filter not working

0
votes

I am trying to query for a date range where a particular field exists. This seems like it would be easy but I am sensing that the keyword "exists" has changed per the documentation. I am on 5.4. https://www.elastic.co/guide/en/elasticsearch/reference/5.4/query-dsl-exists-filter.html

I use @timestamp for dates and the field "error_data" is in the mapping and only appears if an error condition is found.

Here is my query....

GET /filebeat-2017.07.25/_search
{
    "query": {
        "bool" : {
          "filter" : {
            "range" : {
                "@timestamp" : {
                    "gte" : "now-5m",
                    "lte" : "now-1m"
                }
            }
          },
          "exists": {
          "field": "error_data"
          }
        }
    }
}

but it says that "[bool] query does not support [exists]" whereas the following does not work either but gets an parsing error message of "[exists] malformed query, expected [END_OBJECT] but found [FIELD_NAME]" on line 6 column 9. Thanks for your help.

GET /filebeat-2017.07.25/_search
{
    "query": {
        "exists": {
          "field": "error_data"
        }, 
        "bool" : {
          "filter" : {
            "range" : {
                "@timestamp" : {
                    "gte" : "now-5m",
                    "lte" : "now-1m"
                }
            }
          }
        }
    }
}
1
elasticsearch

1 Answers

2
votes

You're almost there. Try like this:

GET /filebeat-2017.07.25/_search
{
    "query": {
        "bool" : {
          "filter" : [
            {
              "range" : {
                "@timestamp" : {
                    "gte" : "now-5m",
                    "lte" : "now-1m"
                }
              }
            },
            {
              "exists": {
                "field": "error_data"
              }
            }
          ]
        }
    }
}

i.e. the bool/filter clause must be an array if you have several clauses to put in it: