query return [parsing_exception] [size] query malformed, no start_object after query name, with { line=1 & col=264 }

问题

I'm new in elasticsearch, and i try to use dev tools to create filters. here is what work and I want to use

POST /transform_alldomain/_search
{
  "size":0,
    "aggs": {
        "group": {
            "terms": {
                "field": "Email.keyword"
            },
            "aggs": {
        "group": {
            "terms": {
                "field": "bln.keyword"
            },
            "aggs": {
                "group_docs": {
                    "top_hits": {
                        "size": 1,
                        "sort": [
                            {
                                "extract_date.max": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                }
            }
        }
    }
}
}}

now i want to use this similiar stuff to filter as type this into filter, edit as query dsl

{
  "size":0,
    "aggs": {
        "group": {
            "terms": {
                "field": "Email.keyword"
            },
            "aggs": {
        "group": {
            "terms": {
                "field": "bln.keyword"
            },
            "aggs": {
                "group_docs": {
                    "top_hits": {
                        "size": 1,
                        "sort": [
                            {
                                "extract_date.max": {
                                    "order": "desc"
                                }
                            }
                        ]
                    }
                }
            }
        }
    }
}
}}

it returns

[parsing_exception] [size] query malformed, no start_object after query name, with { line=1 & col=324 }

I don't know what is the difference and how to make it work

I need to create searched object from this

How I execute the filter:

it returns

回答1:

The Discover app is not the right tool to use to make aggregations, the Discover app is only useful for queries and filters.

What you want to achieve can be done with a Data table visualization. So instead of Discover, go to Visualize, then pick "Create Visualization"

Then pick the "Data Table" Visualization

Then pick your index pattern

And finally you can define your two terms aggregations like this:

来源：https://stackoverflow.com/questions/65271880/query-return-parsing-exception-size-query-malformed-no-start-object-after-q

标签

ElasticSearch

kibana

dsl