Elasticsearch string matching multiple fields in query

Question

I'm trying to query my Elastic Search database and match several fields, however, I get:

[match] malformed query, expected [END_OBJECT] but found [FIELD_NAME]

Which is strange because surely I must be able to use match and then my field name to match some text right?

The fields I'm trying to query are inside my data object, which is custom, and since adding a (dot) doesn't work in here, I'm wrapping that, my data:

{
    "_index": "my_table",
    "_type": "_doc",
    "_id": "IVnGuXcBt3ZsPNCw23Eg",
    "_version": 1,
    "_seq_no": 0,
    "_primary_term": 1,
    "found": true,
    "_source": {
        "mappings": {
            "properties": {
                "period_from": {
                    "type": "date",
                    "format": "yyyy-MM-dd HH:mm:ss",
                    "fielddata": true
                },
                "period_to": {
                    "type": "date",
                    "format": "yyyy-MM-dd HH:mm:ss",
                    "fielddata": true
                },
                "created_at": {
                    "type": "date",
                    "format": "yyyy-MM-dd HH:mm:ss",
                    "fielddata": true
                },
                "updated_at": {
                    "type": "date",
                    "format": "yyyy-MM-dd HH:mm:ss",
                    "fielddata": true
                }
            }
        },
        "data": {
            "dataset": "events",
            "event_category": "test1",
            "event_action": "test2",
            "event_count": "199",
            "period_from": "2021-02-19 00:02:00",
            "period_to": "2021-02-19 10:02:29",
            "created_at": "2021-02-19 10:02:79",
            "updated_at": "2021-02-19 10:02:79"
        },
        "period_from": "2021-02-19 00:02:00",
        "period_to": "2021-02-19 10:02:29",
        "created_at": "2021-02-19 10:02:18",
        "updated_at": "2021-02-19 10:02:18"
    }
}

What am I missing here:

events = await elastic.find('my_table', {
  query: {
    match: {
      'data.event_category': 'test1'
    },
    match: {
      'data.event_action': 'test2'
    },
    range: {
      period_from: {
        gte: moment(from).format('YYYY-MM-DD HH:MM:SS')
      },
      period_to: {
        lte: moment(to).format('YYYY-MM-DD HH:MM:SS')
      }
    }
  }
})

All the match and range conditions need to be wrapped inside a bool/must and/or bool/filter query — Val
– Val, Commented Feb 19, 2021 at 11:22

Jozef - Spatialized.io · Accepted Answer · 2021-02-19 11:21:39Z

1

Once you've correctly set up the date fields' mappings, use this:

{
  query: {
    bool: {
      must: [
        {
          match: {
            "data.event_action": "test2"
          }
        },
        {
          range: {
            period_from: {
              gte:  moment(from).format('YYYY-MM-DD HH:MM:SS')
            }
          }
        },
        {
          range: {
            period_to: {
              lte: moment(to).format('YYYY-MM-DD HH:MM:SS')
            }
          }
        }
      ]
    }
  }
}

answered Feb 19, 2021 at 11:21

Jozef - Spatialized.io

17k4 gold badges29 silver badges79 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ryan H Over a year ago

This seems to work, although returns nothing? Which is odd, no errors, I do indeed have data in the database though

Jozef - Spatialized.io Over a year ago

Check my other answers to your previous questions first :)

Collectives™ on Stack Overflow

Elasticsearch string matching multiple fields in query

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related