elasticsearch bool query error in php client

Question

ElasticSearch returns me [_na] query malformed, no field after start_object error when trying to look up entries using the following query. The field localtime is a new field of documents and exist in every document.

php code,

$qryurl = '<myurl>:<myport>/index/_search?pretty';
$data = array(
"query" => array(
  "bool" => array(
    "must" => array(
      "range" => array(
        "localtime" => array(
          "from" => "2016-06-15T17:43:04.923Z",
          "to" => "2016-06-17T17:43:04.923Z",
          "include_lower" => "true",
          "include_upper" => "true"
        )
      ),
      "term" => array(
        "query" => "1.2.3.4",
        "fields" => array("ip")
      ),
      "query_string" => array(
        "query" => "*up*",
        "default_field" => array("_all")
      )
    )
  )
);

Why does this error appear?

anyhelp will be appreciated ! thanks!

Answer 1

Your bool/must clause must be a pure array not an associative array:

$qryurl = '<myurl>:<myport>/index/_search?pretty';
            $data = array(
                "query" => array (
                    "bool" => array (
                      "must" => array(
                          array(
                             "range" => array ( 
                                  "localtime"  => array (
                                      "from" =>"2016-06-15T17:43:04.923Z",
                                       "to" => "2016-06-17T17:43:04.923Z",
                                       "include_lower" => "true",
                                       "include_upper" => "true"
                                  )
                             )
                          ),
                          array(
                              "term" => array(
                                  "ip" => "1.2.3.4"
                              )
                          ),
                          array(
                              "query_string" => array(
                                  "query" => "*up*",
                                  "default_field" => "_all"
                              )
                          )
                      )
                    )

        )
    );