Exclude in elasticsearch query gives failed to parse search source. expected field name but got [START_OBJECT]

Question

I have following query, which 1. get all data with logtype error. 2. exclude all data in which there is error occured in logmessage fields.

curl -s -XGET 'localhost:9200/index_name/type/_search?pretty=true&size=10' -d '
{
    "query": {
        "match" : {
            "logtype" : "error"
        },
        "should": {
            "bool": {
               "must_not": {
                  "match": {
                     "logMessage": "*error occured*"
                  }
               }
            }
         }
    }
}
'

But the above command gives:

 {
    "error": {
        "root_cause": [{
            "type": "parse_exception",
            "reason": "failed to parse search source. expected field name but got [START_OBJECT]"
        }],
        "type": "search_phase_execution_exception",
        "reason": "all shards failed",
        "phase": "query",
        "grouped": true,
        "failed_shards": [{
            "shard": 0,
            "index": "indexname",
            "node": "HxII3rajS4KP5dkP-ZvPSw",
            "reason": {
                "type": "parse_exception",
                "reason": "failed to parse search source. expected field name but got [START_OBJECT]"
            }
        }]
    },
    "status": 400
 }

How can it be solved?

Answer 1

Try this:

curl -s -XGET 'localhost:9200/index_name/type/_search?pretty=true&size=10' -d '{
  "query": {
    "bool": {
      "must": {
        "match": {
          "logtype": "error"
        }
      },
      "must_not": {
         "match": {
           "logMessage": "*error occured*"
         }
      }
    }
  }
}'