Elasticsearch [bool]格式錯誤的查詢，預計[END_OBJECT]，但找到[FIELD_NAME]

Question

我有一些彈性搜索查詢的問題。 當我使用查詢碼時，它反饋信息 [bool]格式錯誤的查詢，預計[END_OBJECT]，但發現[FIELD_NAME]。

POST /_search 
{ 
    "query": { 
    "bool": { 
    "must": { 
     "match": { 
     "_index": "ntopng-2017.07.26" 
     } 
    }, 
     "filter": { 
     "term": { 
     "IPV4_DST_ADDR": "192.168.0.1" 
    } 
    } 

} , 
"aggs" : { 
    "IN_PKTS" : { "sum" : { "field" :"IN_PKTS" } }, 
    "IN_BYTES" : {"sum" : { "field":"IN_BYTES"} } , 
    "OUT_BYTES" : {"sum" : { "field":"OUT_BYTES"} }, 
    "OUT_PKTS" : { "sum" : { "field" :"OUT_PKTS" } } 

    } 
    } 
} 

Answer 1

AGGS是錯誤的。試試這個：

{ 
    "query": { 
    "bool": { 
     "must": { 
     "match": { 
      "_index": "ntopng-2017.07.26" 
     } 
     }, 
     "filter": { 
     "term": { 
      "IPV4_DST_ADDR": "192.168.0.1" 
     } 
     } 
    } 
    }, 
    "aggs": { 
     "IN_PKTS": { 
     "sum": { 
      "field": "IN_PKTS" 
     } 
     }, 
     "IN_BYTES": { 
     "sum": { 
      "field": "IN_BYTES" 
     } 
     }, 
     "OUT_BYTES": { 
     "sum": { 
      "field": "OUT_BYTES" 
     } 
     }, 
     "OUT_PKTS": { 
     "sum": { 
      "field": "OUT_PKTS" 
     } 
     } 
    } 
}