ElasticSearch - 无法解析搜索源。预期的字段名称，但得到 [START_OBJECT]

Question

我无法弄清楚我的 ES 查询出了什么问题。 我想过滤特定字段，并按其他字段排序。

请求：

GET /_search
{
    "query" : {
        "term": {
          "_type" : "monitor"
        },
        "filtered" : {
            "filter" : { "term" : { "ProcessName" : "myProc" }}
        }
    },
    "sort": { "TraceDateTime": { "order": "desc", "ignore_unmapped": "true" }}
}

回应：

{
   "error": {
      "root_cause": [
         {
            "type": "parse_exception",
            "reason": "failed to parse search source. expected field name but got [START_OBJECT]"
         }
      ],
      "type": "search_phase_execution_exception",
      "reason": "all shards failed",
      "phase": "query",
      "grouped": true,
      "failed_shards": [
         {
            "shard": 0,
            "index": ".kibana",
            "node": "94RPDCjhQh6eoTe6XoRmSg",
            "reason": {
               "type": "parse_exception",
               "reason": "failed to parse search source. expected field name but got [START_OBJECT]"
            }
         }
      ]
   },
   "status": 400
}

Answer 1

您的查询中有语法错误，您需要将两个 term 查询包含在一个 bool/must 复合查询中，它需要是这样的：

POST /_search
{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "ProcessName": "myProc"
              }
            },
            {
              "term": {
                "_type": "monitor"
              }
            }
          ]
        }
      }
    }
  },
  "sort": {
    "TraceDateTime": {
      "order": "desc",
      "ignore_unmapped": "true"
    }
  }
}

PS：在查询中发送有效负载时始终使用 POST。