Hi I am having an instance of elastic search running on my machine . it has an index named mep-reports. when i do a query using curl command it is giving an error . the following is the curl command.

 curl -X GET "10.10.9.1:9200/mep-reports*/_search?pretty&size=0" -H 'Content-Type: application/json' -d'{ "size": 0, "query": { "bool": { "must": [ { "range": { "@timestamp": { "from": "2019-01-31T23:59:59Z", "to": "2020-02-17T23:59:59Z", "include_lower": true, "include_upper": false, "format": "yyyy-MM-dd'T'HH:mm:ssZ", "boost": 1.0 } } }, { "term": { "account_id": { "value": "270d13e6-2f4f-4d51-99d5-92ffba5f0cb6", "boost": 1.0 } } } ], "adjust_pure_negative": true, "boost": 1.0 } }, "aggregations": { "performance_over_time": { "date_histogram": { "field": "@timestamp", "format": "yyyy-MM-dd'T'HH:mm:ssZ", "interval": "1M", "offset": 0, "order": { "_key": "asc" }, "keyed": false, "min_doc_count": 0 } } }
}'
Response
{ "error" : { "root_cause" : [ { "type" : "illegal_argument_exception", "reason" : "Invalid format: [yyyy-MM-ddTHH:mm:ssZ]: Illegal pattern component: T" } ], "type" : "illegal_argument_exception", "reason" : "Invalid format: [yyyy-MM-ddTHH:mm:ssZ]: Illegal pattern component: T", "caused_by" : { "type" : "illegal_argument_exception", "reason" : "Illegal pattern component: T" } }, "status" : 400
}

The following a sample from my elastic search index

{ "took" : 14, "timed_out" : false, "_shards" : { "total" : 12, "successful" : 12, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : 1073013, "max_score" : 1.0, "hits" : [ { "_index" : "mep-reports-2019.09.11", "_type" : "doc", "_id" : "68e8e03f-baf8-4bfc-a920-58e26edf835c-353899837500", "_score" : 1.0, "_source" : { "account_id" : "270d13e6-2f4f-4d51-99d5-92ffba5f0cb6", "inventory" : "SMS", "flight_name" : "test flight 001", "status" : "ENROUTE", "msg_text" : "Test !!!!!!!!!!!!!!1 elastic searchY", "flight_id" : "68e8e03f-baf8-4bfc-a920-58e26edf835c", "submission_ts" : "1568197286", "recipient" : "353899837500", "o_error" : null, "nof_segments" : "-1", "campaign_id" : "0fae8662-bee9-46ac-9b3e-062f4ba55966", "campaign_name" : "Index search petri11", "@version" : "1", "sender" : "800111", "delivery_ts" : "0", "@timestamp" : "2019-09-11T10:21:26.000Z" } } ] }
}

it something related to date format as i am trying to do a search on @timestamp field really appreciate if you can help

thank you

1 Answer

The problem is because the JSON query is enclosed into single quotes, i.e. the same characters around the T in your date format.

What I suggest you to do is to store the query inside a file named query.json and then send it in binary-mode like this:

curl -X GET "10.10.9.1:9200/mep-reports*/_search?pretty&size=0" -H 'Content-Type: application/json' --data-binary @query.json

That should solve your issue

3

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy