Dsl querries

[NourBM (nour)]

Hi, how can i GET those two fields with DSL queries?

[NourBM (nour)]

i tried these commands but i'm not sure of the results
GET metricbeat-7.11.1-2021.02.19-000001/_search
{
"_source": ["process.name","process.state"]
}

[lukeelmers]

@NourBM The query DSL you provided works fine for me. Here's the test case I'm using:

POST test/_doc
{
  "process": {
    "name": "java",
    "state": "sleeping"
  }
}

POST test/_search
{
  "_source": ["process.name", "process.state"]
}

Are you certain those fields have values for all of the documents you are getting back? If those fields are missing in any docs, that would be why you aren't seeing anything in _source.

You can test this by filtering out any docs that don't have a value for those fields:

POST test/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "exists": { "field": "process.name" }
        },
        {
          "exists": { "field": "process.state" }
        }
      ]
    }
  },
  "_source": ["process.name", "process.state"]
}