es query

gistfile1.txt

[2017-08-28T09:52:05,842][DEBUG][o.e.a.s.TransportSearchAction] [log02] [logstash-2017.08.22][5], node[cp0MHe1gT5WwLUlOcw_XDw], [R], s[STARTED], a[id=qJQgMloPR--aAsVXD0UVhw]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[logstash*], indicesOptions=IndicesOptions[id=39, ignore_unavailable=true, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=true, forbid_closed_indices=true], types=[], routing='null', preference='null', requestCache=null, scroll=null, source={
  "size" : 0,
  "query" : {
    "bool" : {
      "filter" : [
        {
          "range" : {
            "@timestamp" : {
              "from" : "1503912042962",
              "to" : "1503913842962",
              "include_lower" : true,
              "include_upper" : true,
              "format" : "epoch_millis",
              "boost" : 1.0
            }
          }
        },
        {
          "query_string" : {
            "query" : "_exists_:cookie_ssid",
            "fields" : [ ],
            "use_dis_max" : true,
            "tie_breaker" : 0.0,
            "default_operator" : "or",
            "auto_generate_phrase_queries" : false,
            "max_determinized_states" : 10000,
            "enable_position_increments" : true,
            "fuzziness" : "AUTO",
            "fuzzy_prefix_length" : 0,
            "fuzzy_max_expansions" : 50,
            "phrase_slop" : 0,
            "analyze_wildcard" : true,
            "escape" : false,
            "split_on_whitespace" : true,
            "boost" : 1.0
          }
        }
      ],
      "disable_coord" : false,
      "adjust_pure_negative" : true,
      "boost" : 1.0
    }
  },
  "aggregations" : {
    "3" : {
      "terms" : {
        "field" : "http_host",
        "size" : 10,
        "min_doc_count" : 1,
        "shard_min_doc_count" : 0,
        "show_term_doc_count_error" : false,
        "order" : [
          {
            "_count" : "desc"
          },
          {
            "_term" : "asc"
          }
        ]
      },
      "aggregations" : {
        "2" : {
          "date_histogram" : {
            "field" : "@timestamp",
            "format" : "epoch_millis",
            "interval" : "30s",
            "offset" : 0,
            "order" : {
              "_key" : "asc"
            },
            "keyed" : false,
            "min_doc_count" : 0,
           "extended_bounds" : {
              "min" : "1503912042962",
              "max" : "1503913842962"
            }
          },
          "aggregations" : {
            "1" : {
              "cardinality" : {
                "field" : "cookie_ssid"
              }
            }
          }
        }
      }
    }
  }
}}] lastShard [true]