I want to express this SQL in Elasticsearch:
select * from ticket where user_id = 1 and (class_a = 1000010 or class_b = 16);
I use a combining filter as below:
curl 'localhost:9200/ticket/_search?pretty' -d'
{
"query": {
"bool": {
"should": [
{"term": {"class_a": 1000010}},
{"term": {"class_b": 16}}
]
},
"filter": {
"term": {
"user_id": 1
}
}
}
}'
but got the error as below:
{
"error" : {
"root_cause" : [ {
"type" : "parse_exception",
"reason" : "failed to parse search source. expected field name but got [START_OBJECT]"
} ],
"type" : "search_phase_execution_exception",
"reason" : "all shards failed",
"phase" : "query_fetch",
"grouped" : true,
"failed_shards" : [ {
"shard" : 0,
"index" : "ticket",
"node" : "FO3-zhb1R1WCak381t88gQ",
"reason" : {
"type" : "parse_exception",
"reason" : "failed to parse search source. expected field name but got [START_OBJECT]"
}
} ]
},
"status" : 400
}
Anyone can help me? Thanks in advance!
You're almost there, you need to rewrite your query like this (i.e. move your filter inside the bool clause):
curl 'localhost:9200/ticket/_search?pretty' -d'{
"query": {
"bool": {
"minimum_should_match": 1,
"should": [
{
"term": {
"class_a": 1000010
}
},
{
"term": {
"class_b": 16
}
}
],
"filter": {
"term": {
"user_id": 1
}
}
}
}
}'
Related
Hii how to ignore datatype error in below query since it throws error when a string value is provided for a field that has non-numeric(long) datatype. I am aware of lenient parameter but it does not work with term query.
GET employee/_search
{
"query": {
"bool": {
"must": [
{
"bool": {
"should": [
{
"terms": {
"employee_id": [
"abcdef"
]
}
},
{
"terms": {
"employee_name": [
"abcdef"
]
}
}
]
}
}
]
}
}
}
Error Message
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: \"abcdef\""
}
Elasticsearch details
"version" : {
"number" : "7.1.1",
"build_flavor" : "oss",
"build_type" : "tar",
"build_hash" : "Unknown",
"build_date" : "2020-11-03T08:48:42.499923Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
}
So the expected behaviour is the datatype error should be ignored and the rest of query runs and produces the result since it is in a should condition and if there is a must condition then give no result
mapping of index
{
"employee" : {
"mappings" : {
"dynamic" : "true",
"properties" : {
"employee_id" : {
"type" : "long"
}
}
}
}
}
You can use the query_string_query instead:
{
"query": {
"bool": {
"must": [
{
"bool": {
"should": [
{
"query_string": {
"query": "employee_id:abcdef" <---
}
},
{
"terms": {
"employee_name": [
"abcdef"
]
}
}
]
}
}
]
}
}
Your original query was a terms query which is equivalent to a logical OR. As such, you can adapt the query string to be:
"employee_id:(abcdef OR xyz OR 123)"
where the value type won't play a role.
I am new to ES, and I am using ES 7.10.1, I have following simple search request:
GET /megacorp/_doc/_search
{
"query":{
"filtered":{
"filter":{
"range":{
"age":{
"gt":30
}
}
},
"query":{
"match":{
"last_name":"smith"
}
}
}
}
}
When I run the above query(using query and filter) in the Kibana Dev Tools, an exception occurs as follows, I would ask how to fix this,thank.
{
"error" : {
"root_cause" : [
{
"type" : "parsing_exception",
"reason" : "unknown query [filtered]",
"line" : 3,
"col" : 14
}
],
"type" : "parsing_exception",
"reason" : "unknown query [filtered]",
"line" : 3,
"col" : 14,
"caused_by" : {
"type" : "named_object_not_found_exception",
"reason" : "[3:14] unknown field [filtered]"
}
},
"status" : 400
}
The filtered query has been deprecated. You should now use the boolean query. Modify your search query as -
{
"query": {
"bool": {
"must": {
"match": {
"last_name": "smith"
}
},
"filter": {
"range": {
"age": {
"gt": 30
}
}
}
}
}
}
I need to filter the records closest to the given coordinates. From the below query removing script_fields will work (gives the results).
Need to get the distance for each matched results.
GET story/_search
{
"_source": [
"title.english", "location"
],
"query": {
"bool": {
"filter": [
{
"geo_distance": {
"distance": "1000km",
"location": {
"lat": 57.3079700,
"lon": 123.4977090
}
}
}
]
}
},
"script_fields": {
"distance": {
"script": "doc['location'].distanceInKm(57.3079700, 123.4977090)"
}
}
}
Below is the error
"failures" : [
{
"shard" : 1,
"index" : "story",
"node" : "asdf-asdf",
"reason" : {
"type" : "script_exception",
"reason" : "runtime error",
"script_stack" : [
"doc['location'].distanceInKm(57.3079700, 123.4977090)",
" ^---- HERE"
],
"script" : "doc['location'].distanceInKm(57.3079700, 123.4977090)",
"lang" : "painless",
"caused_by" : {
"type" : "illegal_argument_exception",
"reason" : "dynamic method [org.elasticsearch.index.fielddata.ScriptDocValues.GeoPoints, distanceInKm/2] not found"
}
}
}
]
},
As #Sharath pointed out, distanceInKm is deprecated. These days you can use arcDistance and convert the value to km through dividing by 1000.
GET my-index-000001/_search
{
...
"script_fields": {
"distance": {
"script": "doc['location'].arcDistance(57.3079700, 123.4977090) / 1000"
}
}
}
Here's the list of currently supported geo methods and here's the arcDistance source.
When i do a multi-condition query and apply field collapsing to one of the field in the mentioned index i get following error
no mapping found for `search_type.keyword` in order to collapse on
Query Used :
GET /_search
{
"query": {
"bool" : {
"must" : [
{
"match" :
{
"id" : "123456"
}
},
{
"terms": {
"_index": ["history"]
}
}
]
}
},
"collapse" : {
"field" : "search_type.keyword",
"inner_hits": {
"name": "terms",
"size": 10
}
}
}
Error Trace:
{
"shard" : 0,
"index" : "test",
"node" : "UOA44HkATh61krg6ht3paA",
"reason" : {
"type" : "illegal_argument_exception",
"reason" : "no mapping found for `search_type.keyword` in order to collapse on"
}
}
Currently, am applying the query only for index - history but the result throws exception for indexes that i haven't mentioned. Please help how to narrow down field collapsing to a particular index.
It appears to be a bug, but if you notice your result carefully, you should be able to view the response you are looking for at the very end after all the such errors are observed.
But then again why not add the index name to the front and modify your query as below:
POST history/_search <---- Add index name here
{
"query": {
"bool": {
"must": [
{
"match": {
"id": "123456"
}
}
]
}
},
"collapse" : {
"field" : "search_type.keyword",
"inner_hits": {
"name": "terms",
"size": 10
}
}
}
I'm creating a query on Elasticsearch, for find documents through all indices.
I need to combine should, must and nested query on Elasticsearch, i get the right result but i get an error inside the result.
This is the query I'm using
GET _all/_search
{
"query": {
"bool": {
"minimum_should_match": 1,
"should": [
{ "term": { "trimmed_final_url": "https://www.repubblica.it/t.../" } }
],
"must": [
{
"nested": {
"path": "entities",
"query": {
"bool": {
"must": [
{ "term": { "entities.id": "138511" } }
]
}
}
}
},
{
"term": {
"language": { "value": "it" }
}
}
]
}
}
And this is the result
{
"_shards" : {
"total" : 38,
"successful" : 14,
"skipped" : 0,
"failed" : 24,
"failures" : [
{
"shard" : 0,
"index" : ".kibana_1",
"node" : "7twsq85TSK60LkY0UiuWzA",
"reason" : {
"type" : "query_shard_exception",
"reason" : """
failed to create query: {
...
"index_uuid" : "HoHi97QFSaSCp09iSKY1DQ",
"index" : ".reporting-2019.06.02",
"caused_by" : {
"type" : "illegal_state_exception",
"reason" : "[nested] failed to find nested object under path [entities]"
}
}
},
...
"hits" : {
"total" : {
"value" : 50,
"relation" : "eq"
},
"max_score" : 16.90015,
"hits" : [
{
"_index" : "i_201906_v1",
"_type" : "_doc",
"_id" : "MugcbmsBAzi8a0oJt96Q",
"_score" : 16.90015,
"_source" : {
"language" : "it",
"entities" : [
{
"id" : 101580,
},
{
"id" : 156822,
},
...
I didn't write some fields because the code is too long
I am new to StackOverFlow (made this account to answer this question :D) so if this answer is out of line bear with me. I have been dabbling in nested fields in Elasticsearch recently so I have some ideas as to how this error could be appearing.
Have you defined a mapping for your document type? I don't believe Elasticsearch will recognize the field as nested if you do not tell it to do so in the mapping:
PUT INDEX_NAME
{
"mappings": {
"DOC_TYPE": {
"properties": {
"entities": {"type": "nested"}
}
}
}
}
You may have to specify this mapping for each index and document type. Not sure if there is a way to do that all with one request.
I also noticed you have a "should" clause with minimum matches set to 1. I believe this is exactly the same as a "must" clause so I am not sure what purpose this achieves (correct me if I'm wrong). If your mapping is specified, the query should look something like this:
GET /_all/_search
{
"query": {
"bool": {
"must": [
{
"nested": {
"path": "entities",
"query": {
"term": {
"entities.id": {
"value": "138511"
}
}
}
}
},
{
"term": {
"language": {
"value": "it"
}
}
},
{
"term": {
"trimmed_final_url": {
"value": "https://www.repubblica.it/t.../"
}
}
}
]
}
}
}