# Cannot search for \_source.fields in Kibana
**URL:** https://discuss.elastic.co/t/cannot-search-for-source-fields-in-kibana/190551
**Category:** Logstash
**Created:** [July 15, 2019, 1:57pm UTC](https://discuss.elastic.co/t/cannot-search-for-source-fields-in-kibana/190551 "2019-07-15T13:57:16Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [July 15, 2019, 1:57pm UTC](https://discuss.elastic.co/t/cannot-search-for-source-fields-in-kibana/190551/1 "2019-07-15T13:57:16Z")
Hello everyone,
I have a problem with searching for fields that I specified in Logstash filter. In particular I cannot search for syslog\_timestamp that I created in filter.conf file in Logstash.
I defined the syslog\_timestamp as follows:
```
%{SYSLOGTIMESTAMP:syslog_timestamp}
```
I also have defined duration field in the same .conf file which I can search for in Kibana by typing \_source.duration somevalue and it works good. Maybe I have wrong syntax for searching for syslog\_timestamp data type...
In console I can make a query:
```
GET /my_index/_search
{"query": {
"match_phrase": {
"syslog_timestamp": "Jul 4 13:56:15"
}
}
}
```
And appropriate result is found!
Has anyone had any similar problem recently?
I'm thinking about change the grok parsing from the beginning and don't use the `SYSLOGTIMESTAMP` pattern for parsing the date. Do you have any ideas how else to parse date in this form : `Jul 4 13:56:15`
Every message in the file is in this form:
```
Jul 4 13:56:17 vMMR mmr-core[29839]: GtsAwegAOMTbez_1562241377271986.mt npdbProfiling-end: pid[29839] table[npdbcz] operation[SELECT] duration[6.27 ms] error [] sql[SELECT carrier,validity,now()>validity as now_valid FROM npdbcz WHERE `range` IN ('606339842','60633984','6063398','606339','60633','6063') ORDER BY now_valid DESC,validity DESC]
```
My current solution:
```
%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:hostname} %{DATA:type} %{SPACE} %{DATA:file_id} %{DATA:file_name} %{DATA:syslog_pid} .*table\s*\[%{WORD:table}\] .*operation\s*\[%{WORD:operation}\] .*duration\s*\[%{NUMBER:duration:float} ms\] %{GREEDYDATA:rest}
```
Any advice would be appreciated!!!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 15, 2019, 8:17pm UTC](https://discuss.elastic.co/t/cannot-search-for-source-fields-in-kibana/190551/2 "2019-07-15T20:17:12Z")
In Kibana, does syslog\_timestamp show as a text field, or as a timestamp field?
---
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [July 16, 2019, 6:57pm UTC](https://discuss.elastic.co/t/cannot-search-for-source-fields-in-kibana/190551/3 "2019-07-16T18:57:09Z")
@Badger Thank you for your reply!
How can I find out if it is text field or timestamp field ? 😄
This is how I see it in Kibana:
I'd like to search in search panel by typing for example Jul 4 13:56:15 and see logs only from this particular date.
When I type \_source.duration 11 it works...
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 16, 2019, 7:31pm UTC](https://discuss.elastic.co/t/cannot-search-for-source-fields-in-kibana/190551/4 "2019-07-16T19:31:06Z")
In the list of fields on the left, you can see a symbol to the left of @timestamp that indicates it is a timestamp, whilst to the left of @version is a t for text.
You will need to refresh the index-pattern in the Kibana management pane and then see which symbol shows up next to syslog\_timestamp. I would expect the ? to change to either t or the clock.
---
### Author:  [@Vladpov](https://discuss.elastic.co/u/Vladpov)
#### Post date: [July 16, 2019, 8:10pm UTC](https://discuss.elastic.co/t/cannot-search-for-source-fields-in-kibana/190551/5 "2019-07-16T20:10:26Z")
Thank you for your pieces of advice again! 🙂
I refreshed the index-pattern and it works but symbol of syslogt\_timestamp hasn't changed (there is sit question mark). But I can searching for the date now.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 13, 2019, 8:10pm UTC](https://discuss.elastic.co/t/cannot-search-for-source-fields-in-kibana/190551/6 "2019-08-13T20:10:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.