matt.crawfoord matt.crawfoord - 5 months ago 20
PHP Question

elasticsearch bool query error in php client

ElasticSearch returns me "[_na] query malformed, no field after start_object" error when trying to look up entries using the following query. The field localtime is a new field of documents and exist in every document.

curl -XGET '<myurl>:<myport>/index/_search?pretty' -d '
{
"query": {
"bool": {
"must": [
{
"term": {
"ip": "1.2.3.4"
}
},
{
"range": {
"localtime": {
"from": "2016-06-15T06:00:04.923Z",
"to": "2016-06-17T17:43:04.923Z",
"include_lower": true,
"include_upper": true
}
}
},
{
"query_string": {
"default_field": "_all",
"query": "word1 OR word1"
}
}
]
}
}
}'


php code,

$qryurl = '<myurl>:<myport>/index/_search?pretty';
$data = array(
"query" => array (
"bool" => array (
"must" => array(
"range" => array (
"localtime" => array (
"from" =>"2016-06-15T17:43:04.923Z",
"to" => "2016-06-17T17:43:04.923Z",
"include_lower" => "true",
"include_upper" => "true"
)
),
"term" => array(
"query" => "1.2.3.4",
"fields" => array("ip")
),
"query_string" => array(
"query" => "*up*",
"default_field" => array("_all")
)
)


)
);


Why does this error appear?


anyhelp will be appreciated ! thanks!

Val Val
Answer

Your bool/must clause must be a pure array not an associative array:

$qryurl = '<myurl>:<myport>/index/_search?pretty';
            $data = array(
                "query" => array (
                    "bool" => array (
                      "must" => array(
                          array(
                             "range" => array ( 
                                  "localtime"  => array (
                                      "from" =>"2016-06-15T17:43:04.923Z",
                                       "to" => "2016-06-17T17:43:04.923Z",
                                       "include_lower" => "true",
                                       "include_upper" => "true"
                                  )
                             )
                          ),
                          array(
                              "term" => array(
                                  "ip" => "1.2.3.4"
                              )
                          ),
                          array(
                              "query_string" => array(
                                  "query" => "*up*",
                                  "default_field" => "_all"
                              )
                          )
                      )
                    )

        )
    );