# Cannot Query event.original
**URL:** https://discuss.elastic.co/t/cannot-query-event-original/212524
**Category:** Elasticsearch
**Tags:** beats-module
**Created:** [December 19, 2019, 4:47pm UTC](https://discuss.elastic.co/t/cannot-query-event-original/212524 "2019-12-19T16:47:35Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@jameswatson3](https://discuss.elastic.co/u/jameswatson3)
#### Post date: [December 19, 2019, 4:47pm UTC](https://discuss.elastic.co/t/cannot-query-event-original/212524/1 "2019-12-19T16:47:35Z")
I cannot query fields in documents ingested by the elasticsearch filebeat-7.5.0-cisco-ftd-asa-ftd-pipeline. I have already posted this query on the Beats forum but have received no reply so I was hoping someone here could offer some advice.
Essentially I used the filebeat module cisco --pipelines command to create ingest pipelines in elasticsearch. Everything related to ingesting my cisco logs using that pipeline is working great except for the fact that I cannot query any phrase in any field unless it is an exact match. I cannot simply use a match query to find documents containing individual words or phrases.
If I index the exact same logs through logstash without sending through the filebeat-7.5.0-cisco-ftd-asa-ftd-pipeline, then behavior is exactly like I have always experienced and I can query as normal.
From what I can see from GET \_ingest/pipeline/, it appears that the original message is being processed into log.original, then into event.orginal but I can't make out more than that.
Can anyone help me understand what I'm experiencing?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2020, 4:47pm UTC](https://discuss.elastic.co/t/cannot-query-event-original/212524/2 "2020-01-16T16:47:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.