没有为｛某个日期存在字段｝注册查询

Question

我使用的是elasticsearch 2.3.1，得到的错误是：

没有为[TraceDateTime]注册查询。

请求：

POST /_search
{
  "query": {
        "bool": {
          "must": [
            {
              "term": {
                "_type": "monitor"
              },
              "range" : {
                "TraceDateTime" : {
                  "gte" : "2016-04-08 13:59:50",
                  "lte" : "2016-04-10 13:59:50",
                  "boost" : 2.0
                  }
                }
            }
          ]
        }
  },
  "sort": {
    "TraceDateTime": {
      "order": "desc",
      "ignore_unmapped": "true"
    }
  }
}

响应：

{
   "error": {
      "root_cause": [
         {
            "type": "query_parsing_exception",
            "reason": "No query registered for [TraceDateTime]",
            "index": ".kibana",
            "line": 10,
            "col": 17
         },
         {
            "type": "query_parsing_exception",
            "reason": "No query registered for [TraceDateTime]",
            "index": "monitors",
            "line": 10,
            "col": 17
         }
      ],
      "type": "search_phase_execution_exception",
      "reason": "all shards failed",
      "phase": "query",
      "grouped": true,
      "failed_shards": [
         {
            "shard": 0,
            "index": ".kibana",
            "node": "94RPDCjhQh6eoTe6XoRmSg",
            "reason": {
               "type": "query_parsing_exception",
               "reason": "No query registered for [TraceDateTime]",
               "index": ".kibana",
               "line": 10,
               "col": 17
            }
         },
         {
            "shard": 0,
            "index": "monitors",
            "node": "94RPDCjhQh6eoTe6XoRmSg",
            "reason": {
               "type": "query_parsing_exception",
               "reason": "No query registered for [TraceDateTime]",
               "index": "monitors",
               "line": 10,
               "col": 17
            }
         }
      ]
   },
   "status": 400
}

Answer 1

在我看来，你把term后面的大括号放错地方了。

POST /_search
{
  "query": {
        "bool": {
          "must": [
            {
              "term": {
                "_type": "monitor"
              }},
              {
                "range" : {
                    "TraceDateTime" : {
                      "gte" : "2016-04-08 13:59:50",
                      "lte" : "2016-04-10 13:59:50",
                      "boost" : 2.0
                      }
                }
             }
          ]
        }
  },
  "sort": {
    "TraceDateTime": {
      "order": "desc",
      "ignore_unmapped": "true"
    }
  }
}