# Cisco Module - Cannot Query Event.Original field
**URL:** https://discuss.elastic.co/t/cisco-module-cannot-query-event-original-field/212433
**Category:** Beats
**Tags:** filebeat
**Created:** [December 19, 2019, 3:58am UTC](https://discuss.elastic.co/t/cisco-module-cannot-query-event-original-field/212433 "2019-12-19T03:58:43Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@jameswatson3](https://discuss.elastic.co/u/jameswatson3)
#### Post date: [December 19, 2019, 3:58am UTC](https://discuss.elastic.co/t/cisco-module-cannot-query-event-original-field/212433/1 "2019-12-19T03:58:44Z")
The filebeat 7.5 Cisco module is successfully sending asa, ftd and ios documents to elasticsearch. Using the pipelines created by filebeat modules cisco --pipelines, the documents are being parsed nicely and stats are visible in the respective kibana dashboards.
However, I can now no longer query any word or phrase in the event.original field which is equivalent to the message field for documents that did not use the pipeline. If a document is indexed without using the pipeline, I can query words or phrases in the equivalent message field. I can also query the log.original field of the cisco-ios pipeline but not event.original of the cisco-ftp pipeline.
I see from GET \_ingest/pipeline that the filebeat-7.5.0-cisco-ftd-asa-ftd-pipeline seems to convert message to log.original then to event.orginal in some way. I have to assume that something about this process is what makes that field unqueryable.
```
"rename" : {
"field" : "log.original",
"target_field" : "event.original",
"ignore_missing" : true
}
```
Any advice on how I might be able to query words or phrases on event.original in these documents?
---
### Author:  [@jameswatson3](https://discuss.elastic.co/u/jameswatson3)
#### Post date: [December 19, 2019, 8:24pm UTC](https://discuss.elastic.co/t/cisco-module-cannot-query-event-original-field/212433/2 "2019-12-19T20:24:40Z")
I have documented additional detail at [https://gist.github.com/RuMORDeN/299c5245e680a72c44061b4891c535e2](https://gist.github.com/RuMORDeN/299c5245e680a72c44061b4891c535e2)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2020, 8:24pm UTC](https://discuss.elastic.co/t/cisco-module-cannot-query-event-original-field/212433/3 "2020-01-16T20:24:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.