Search code examples
elasticsearchkibanadsl

query return [parsing_exception] [size] query malformed, no start_object after query name, with { line=1 & col=264 }

I'm new in elasticsearch, and i try to use dev tools to create filters. here is what work and I want to use

POST /transform_alldomain/_search
{
  "size":0,
    "aggs": {
        "group": {
            "terms": {
                "field": "Email.keyword"
            },
            "aggs": {
        "group": {
            "terms": {
                "field": "bln.keyword"
            },
            "aggs": {
                "group_docs": {
                    "top_hits": {
                        "size": 1,
                        "sort": [
                            {
                                "extract_date.max": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                }
            }
        }
    }
}
}}

now i want to use this similiar stuff to filter as type this into filter, edit as query dsl

{
  "size":0,
    "aggs": {
        "group": {
            "terms": {
                "field": "Email.keyword"
            },
            "aggs": {
        "group": {
            "terms": {
                "field": "bln.keyword"
            },
            "aggs": {
                "group_docs": {
                    "top_hits": {
                        "size": 1,
                        "sort": [
                            {
                                "extract_date.max": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                }
            }
        }
    }
}
}}

it returns

[parsing_exception] [size] query malformed, no start_object after query name, with { line=1 & col=324 }

I don't know what is the difference and how to make it work

I need to create searched object from this

How I execute the filter:

enter image description here

it returns

enter image description here

Solution

  • The Discover app is not the right tool to use to make aggregations, the Discover app is only useful for queries and filters.

    What you want to achieve can be done with a Data table visualization. So instead of Discover, go to Visualize, then pick "Create Visualization"

    Create Visualization

    Then pick the "Data Table" Visualization

    Data Table

    Then pick your index pattern

    Index pattern

    And finally you can define your two terms aggregations like this:

    Terms aggregations