I cant figure out what's wrong with this query. Both "range" and "exists" work independently, but together I get parsing expection and range malformed query, expected END_OBJECT but found FIELD_NAME. Can someone figure out what's wrong with this query?
{
"query": {
"range":{
"@timestamp":{
"gte":"2019-08-04T11:00:00",
"lt":"2019-10-04T12:00:00"
}
},
"exists": {
"field": "params.zone"
}
},
"_source": ["@timestamp", "params.zone"]
}
If you want to combine several queries like you're doing with range and exists you need to use bool query and decided which of your clauses are mandatory (must), optional (should), filter (filter), or shouldn't be presented in results (must_not)
Query which would work could look like this (you're clauses are mandatory in this example):
{
"query": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gte": "2019-08-04T11:00:00",
"lt": "2019-10-04T12:00:00"
}
}
},
{
"exists": {
"field": "params.zone"
}
}
]
}
},
"_source": [
"@timestamp",
"params.zone"
]
}
