# Cannot search on field \[log.original\] since it is not indexed
**URL:** https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897
**Category:** Elasticsearch
**Created:** [February 1, 2022, 3:12am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897 "2022-02-01T03:12:51Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 1, 2022, 3:12am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/1 "2022-02-01T03:12:51Z")
Hi --I am not sure how to diagnose this issue. My searching has offered no results.
When I try to refine my iptables query with \> log.original: "ID=1234" I get the error:
`failed to create query: Cannot search on field [log.original] since it is not indexed.`
I am surprised to find this error because the log.original field has the 't' icon which I understood meant it is indexed. Either way, can you please help me determine if this is or is not indexed, and if not, how can I achieve that?
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [February 1, 2022, 3:25am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/2 "2022-02-01T03:25:25Z")
Check index mapping first. What it says by
`GET /your-index/`?
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 1, 2022, 4:11am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/3 "2022-02-01T04:11:36Z")
Thanks. I did this in dev tools `GET /filebeat-*/?` and got 29, 138 lines! I am unable to find anything with `log.original` specifically. What should I be looking for?
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [February 1, 2022, 4:18am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/4 "2022-02-01T04:18:48Z")
What will happen if you specify a single index without wild card.
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 1, 2022, 4:38am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/5 "2022-02-01T04:38:44Z")
I have only these index. All of them give the same results with 29, 138 lines.
```auto
GET /filebeat-7.16.3-2022.01.23-000001/?
GET /filebeat-7.16.3/?
```
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [February 1, 2022, 4:52am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/6 "2022-02-01T04:52:25Z")
find "original" field in "log" field
---
### Author:  [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)
#### Post date: [February 1, 2022, 5:49am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/7 "2022-02-01T05:49:49Z")
Check you index \_mapping;
```auto
GET //_mapping
```
and make sure your log.original fields index option is not set to false;
[Mapping Index](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-index.html)
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 1, 2022, 6:23am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/8 "2022-02-01T06:23:23Z")
I think this is what you are requesting. At line 11643:
```auto
"log" : {
"properties" : {
"file" : {
"properties" : {
"path" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
},
"flags" : {
"type" : "keyword",
"ignore_above" : 1024
},
"level" : {
"type" : "keyword",
"ignore_above" : 1024
},
"logger" : {
"type" : "keyword",
"ignore_above" : 1024
},
"offset" : {
"type" : "long"
},
"origin" : {
"properties" : {
"file" : {
"properties" : {
"line" : {
"type" : "long"
},
"name" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
},
"function" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
},
"original" : {
"type" : "keyword",
"index" : false,
"doc_values" : false,
"ignore_above" : 1024
},
"source" : {
"properties" : {
"address" : {
"type" : "keyword",
"ignore_above" : 1024
}
}
},
```
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [February 1, 2022, 6:27am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/9 "2022-02-01T06:27:57Z")
> [@mevan](#):
>
> ```auto
> "original" : {
> "type" : "keyword",
> "index" : false,
>
> ```
This is the reason you got the error. The settings is set by you? If you want to query on the field, You have to ask those who maintenance the index.
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 1, 2022, 6:30am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/10 "2022-02-01T06:30:08Z")
> [@can.ozdemir](#):
>
> ```auto
> GET //_mapping
>
> ```
This produced the same as what I pasted just now. If I understand this correctly the index option is false but how would I change that to true?
```auto
"original" : {
"type" : "keyword",
"index" : false,
"doc_values" : false,
"ignore_above" : 1024
},
```
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 1, 2022, 6:31am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/11 "2022-02-01T06:31:25Z")
It is only me. I must try to discover how to change the setting.
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [February 1, 2022, 6:39am UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/12 "2022-02-01T06:39:36Z")
Though I don't remember if possible, try update mappings API.
> **[Update mapping API | Elasticsearch Guide \[7.16\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html#updating-field-mappings)**
If it doesn't work, you have to create new index with desired mappings and reindex to it.
---
### Author:  [@mevan](https://discuss.elastic.co/u/mevan)
#### Post date: [February 1, 2022, 9:32pm UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/14 "2022-02-01T21:32:09Z")
I will try this later today. Thank you Tomo!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 1, 2022, 9:32pm UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897/15 "2022-03-01T21:32:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.