elasticsearch 查询 GCP alpha 和 beta api

Question

trying to get this query below to work on GCP. need this to query for beta api's being used every 24 hours. keep getting error in the query. probably a simple syntax error, but im not seeing it.

    GET /gcp-%2A/_search
{
    "query": {
          "range" : {
            "timestamp" : {
                "gte" : "now-1d/d",
                "lt" :  "now/d"
            }
        },
            "wildcard": {
            "protoPayload.methodName": {
                "value": "*beta*",
                "boost": 1.0,
                "rewrite": "constant_score"
            }
        }
    }
}

{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "[range] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
        "line": 9,
        "col": 13
      }
    ],
    "type": "parsing_exception",
    "reason": "[range] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
    "line": 9,
    "col": 13
  },
  "status": 400
}

Answer 1

You were almost there:

GET /gcp-%2A/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "timestamp": {
              "gte": "now-1d/d",
              "lt": "now/d"
            }
          }
        },
        {
          "wildcard": {
            "protoPayload.methodName": {
              "value": "*beta*",
              "boost": 1,
              "rewrite": "constant_score"
            }
          }
        }
      ]
    }
  }
}