Elasticsearch 7 x_content_parse_exception failed to parse field [must]

Question

My Query which returns the error: elasticsearch.exceptions.RequestError: RequestError(400, 'x_content_parse_exception', '[8:43] [bool] failed to parse field [must]')

I have tried replacing the [] with {} but that hasen't helped

    chunksize, chunk, double_chunk = ssdeep_value.split(":")
    chunksize = int(chunksize)
    twice_chunksize = chunksize*2
    half_chunksize = chunksize*0.5

    query = """
    {
        "query": {
            "bool": {
                "must": [
                    {
                        "terms": {
                            "chunksize": [chunksize, twice_chunksize, half_chunksize]
                        }
                    },
                    {
                        "bool": {
                            "should": [
                                {
                                    "match": {
                                        "chunk": {
                                            "query": chunk,
                                        }
                                    }
                                },
                                {
                                    "match": {
                                        "double_chunk": {
                                            "query": double_chunk,
                                        }
                                    }
                                }
                            ],
                            "minimum_should_match": 1
                        }
                    }
                ]
            }
        }
    }
    """

    results = es.search(index="ssdeep-index", body=query)

Jozef - Spatialized.io · Accepted Answer · 2021-03-25 18:47:44Z

1

The body parameter (query in your case) is supposed to be a dictionary, not a multiline string.

So use:

query = {
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "chunksize": [chunksize, twice_chunksize, half_chunksize]
          }
        },
        {
          "bool": {
            "should": [
              {
                "match": {
                  "chunk": {
                    "query": chunk
                  }
                }
              },
              {
                "match": {
                  "double_chunk": {
                    "query": double_chunk
                  }
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ]
    }
  }
}

results = es.search(index="ssdeep-index", body=query)

answered Mar 25, 2021 at 18:47

Jozef - Spatialized.io

17k4 gold badges29 silver badges79 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

DL_Engineer Over a year ago

You are god-sent. Thank you again!

Collectives™ on Stack Overflow

Elasticsearch 7 x_content_parse_exception failed to parse field [must]

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related