can't figure our error 400 for elasticsearch query

Question

I'm just trying to use elastic search and I ran this query:

curl -XPOST "http://host/logstash-2016.05.19/_search" -d'

{
  "query": {
        { "match": { "serviceName": "systemA" } }
  }
}'

but keep getting this error:

{
   "error": "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[hTYqYg0RSt2XZrYWxwMQ3g][logstash-2016.05.19][0]: RemoteTransportException[[es1][inet[/10.149.76.25:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[logstash-2016.05.19][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n  \"query\": {\n        { \"match\": { \"serviceName\": \"bsHolds\" } }\n  }\n}\n]]]; nested: QueryParsingException[[logstash-2016.05.19] Failed to parse]; nested: JsonParseException[Unexpected character ('{' (code 123)): was expecting either valid name character (for unquoted name) or double-quote (for quoted) to start field name\n at [Source: UNKNOWN; line: 3, column: 10]]; }{[asrIxDjBSJeKvDTT7zfgMQ][logstash-2016.05.19][1]: RemoteTransportException[[es5][inet[/10.149.76.155:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[logstash-2016.05.19][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n  \"query\": {\n        { \"match\": { \"serviceName\": \"bsHolds\" } }\n  }\n}\n]]]; nested: QueryParsingException[[logstash-2016.05.19] Failed to parse]; nested: JsonParseException[Unexpected character ('{' (code 123)): was expecting either valid name character (for unquoted name) or double-quote (for quoted) to start field name\n at [Source: UNKNOWN; line: 3, column: 10]]; }{[asrIxDjBSJeKvDTT7zfgMQ][logstash-2016.05.19][2]: RemoteTransportException[[es5][inet[/10.149.76.155:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[logstash-2016.05.19][2]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n  \"query\": {\n        { \"match\": { \"serviceName\": \"bsHolds\" } }\n  }\n}\n]]]; nested: QueryParsingException[[logstash-2016.05.19] Failed to parse]; nested: JsonParseException[Unexpected character ('{' (code 123)): was expecting either valid name character (for unquoted name) or double-quote (for quoted) to start field name\n at [Source: UNKNOWN; line: 3, column: 10]]; }{[PwDi_CIiQHmOHp34KdWk0A][logstash-2016.05.19][3]: RemoteTransportException[[es3][inet[/10.149.76.97:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[logstash-2016.05.19][3]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n  \"query\": {\n        { \"match\": { \"serviceName\": \"bsHolds\" } }\n  }\n}\n]]]; nested: QueryParsingException[[logstash-2016.05.19] Failed to parse]; nested: JsonParseException[Unexpected character ('{' (code 123)): was expecting either valid name character (for unquoted name) or double-quote (for quoted) to start field name\n at [Source: UNKNOWN; line: 3, column: 10]]; }{[PwDi_CIiQHmOHp34KdWk0A][logstash-2016.05.19][4]: RemoteTransportException[[es3][inet[/10.149.76.97:9300]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[logstash-2016.05.19][4]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\n  \"query\": {\n        { \"match\": { \"serviceName\": \"bsHolds\" } }\n  }\n}\n]]]; nested: QueryParsingException[[logstash-2016.05.19] Failed to parse]; nested: JsonParseException[Unexpected character ('{' (code 123)): was expecting either valid name character (for unquoted name) or double-quote (for quoted) to start field name\n at [Source: UNKNOWN; line: 3, column: 10]]; }]",
   "status": 400
}

not sure what it means but I'm trying to follow the guides on elastic.co but I keep getting that 400 error on any query...

Val · Accepted Answer · 2016-05-22 05:56:35Z

3

You have too many curly braces. Try this query instead

curl -XPOST "http://host/logstash-2016.05.19/_search" -d'{
  "query": {
     "match": { "serviceName": "systemA" }
  }
}'

If you're using Sense you need to make your query like this:

POST /logstash-2016.05.19/_search
{
  "query": {
     "match": { "serviceName": "systemA" }
  }
}

edited May 22, 2016 at 5:56

answered May 21, 2016 at 4:49

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

lightweight Over a year ago

I get a syntax error for that one...Expected one of GET/POST/PUT/DELETE/HEAD Syntax error....I'm also using Sense chrome extension too...

Collectives™ on Stack Overflow

can't figure our error 400 for elasticsearch query

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related