ElasticSearch - 无法解析搜索源。预期的字段名称但得到了 [START_OBJECT]

Question

我不知道我的 ES 查询有什么问题。我想按特定字段进行筛选，并按其他字段排序。

请求:

GET /_search
{
    "query" : {
        "term": {
          "_type" : "monitor"
        },
        "filtered" : {
            "filter" : { "term" : { "ProcessName" : "myProc" }}
        }
    },
    "sort": { "TraceDateTime": { "order": "desc", "ignore_unmapped": "true" }}
}

响应:

{
   "error": {
      "root_cause": [
         {
            "type": "parse_exception",
            "reason": "failed to parse search source. expected field name but got [START_OBJECT]"
         }
      ],
      "type": "search_phase_execution_exception",
      "reason": "all shards failed",
      "phase": "query",
      "grouped": true,
      "failed_shards": [
         {
            "shard": 0,
            "index": ".kibana",
            "node": "94RPDCjhQh6eoTe6XoRmSg",
            "reason": {
               "type": "parse_exception",
               "reason": "failed to parse search source. expected field name but got [START_OBJECT]"
            }
         }
      ]
   },
   "status": 400
}

Answer 1

您的查询中存在语法错误，您需要将两个 term 查询包含在 bool/must 复合查询中，它需要像这样:

POST /_search
{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "ProcessName": "myProc"
              }
            },
            {
              "term": {
                "_type": "monitor"
              }
            }
          ]
        }
      }
    }
  },
  "sort": {
    "TraceDateTime": {
      "order": "desc",
      "ignore_unmapped": "true"
    }
  }
}

PS:在您的查询中发送负载时始终使用 POST。