Im trying to use Named Queries to see which condition was met, either tag-one or tag-two, but its not working, what is the correct way to achieve this? The example states that the "_name" tag should be used inside a bool which is it, so im not sure what the problem could be.

GET /myindex/_search
{
  "_source": ["ids"],
    "query": {
        "bool": {
            "must": [
              {
                    "range": {
                        "timestamp": {
                          "format": "strict_date_optional_time",
                          "gte": "2022-02-21T20:44:07.099Z",
                          "lte": "2022-03-23T20:44:07.099Z"
                        }
                    }
                },
                {
                    "bool": {
                        "should": [
                          {
                          "_name": "tag-one",
                            "query_string": {
                              "query":"*hello*",
                                "fields":["field1","field2","field3"]
                            }
                        },
                        {
                            "query_string": {
                                "query":"*world*",
                                "fields":["field1","field2","field3"]
                            },
                             "_name": "tag-two"
                        }
                        ]
                    }
                }
            ]
        }
    },
    "size": 10000
}

the error I get:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "parsing_exception",
        "reason" : "[_name] query malformed, no start_object after query name",
        "line" : 19,
        "col" : 18
      }
    ],
    "type" : "x_content_parse_exception",
    "reason" : "[19:18] [bool] failed to parse field [must]",
    "caused_by" : {
      "type" : "x_content_parse_exception",
      "reason" : "[19:18] [bool] failed to parse field [should]",
      "caused_by" : {
        "type" : "parsing_exception",
        "reason" : "[_name] query malformed, no start_object after query name",
        "line" : 19,
        "col" : 18
      }
    }
  },
  "status" : 400
}

CodePudding user response：

From Elasticsearch documentation

Each query accepts a _name in its top-level definition. You can use named queries to track which queries matched returned documents.

You need to include the _named query inside the query_string. Modify your search query as

{
    "_source": [
        "ids"
    ],
    "query": {
        "bool": {
            "must": [
                {
                    "range": {
                        "timestamp": {
                            "format": "strict_date_optional_time",
                            "gte": "2022-02-21T20:44:07.099Z",
                            "lte": "2022-03-23T20:44:07.099Z"
                        }
                    }
                },
                {
                    "bool": {
                        "should": [
                            {
                                "query_string": {
                                    "query": "*hello*",
                                    "fields": [
                                        "field1",
                                        "field2",
                                        "field3"
                                    ],
                                    "_name": "tag-one"           //note this
                                }
                            },
                            {
                                "query_string": {
                                    "query": "*world*",
                                    "fields": [
                                        "field1",
                                        "field2",
                                        "field3"
                                    ],
                                    "_name": "tag-two"
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "size": 10000
}