# Elastic Agent - ZIA integration

**URL:** <https://discuss.elastic.co/t/elastic-agent-zia-integration/376336>\
**Category:** Elastic Agent\
**Created:** [March 24, 2025, 3:37pm UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336 "2025-03-24T15:37:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [March 24, 2025, 3:37pm UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336/1 "2025-03-24T15:37:46Z")

</div>

I recently set up ZIA integration with Elastic agent, we are getting the Datastreams but are unable to search for anything, anything comes back with no results , verified default template and all fields are keywords but if i do a Filter , it works .

You just cant search for a keyword in the KQL syntax

not sure what im doing wrong here

---

<div class="post-metadata">

**Author:** ![Musab\_Dogan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/musab_dogan/32/70691_2.png) [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\
**Post date:** [March 25, 2025, 12:36am UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336/2 "2025-03-25T00:36:09Z")

</div>

So I assume you are using [Zscaler ZIA | Elastic integrations | Elastic](https://www.elastic.co/guide/en/integrations/current/zscaler_zia.html) Zscaler Internet Access (ZIA) elastic agent integration with Fleet server.

Because all the fields indexed as `keyword` you can't use full-text-search feature but you can always search with wildcard/regex.

for example, in KQL the following query should return if the field exist. `csport: *`.

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [March 26, 2025, 1:18pm UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336/3 "2025-03-26T13:18:35Z")

</div>

By default , why wouldnt the full-text-search feature work ? and how do you get it to work ?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 26, 2025, 1:25pm UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336/4 "2025-03-26T13:25:14Z")

</div>

> [@Elk\_huh](#):
>
> You just cant search for a keyword in the KQL syntax
> 
> not sure what im doing wrong here

Can you share exactly what you are trying to do? Please share some screenshots for example.

> [@Elk\_huh](#):
>
> By default , why wouldnt the full-text-search feature work ? and how do you get it to work ?

Full-text search is done on fields that are mapped as texted, the majority of fields do not need to be mapped as text because they contain just keywords, so they are mapped as keywords.

Keywords fields need to be search for the exact match, case sensitive, or for part of it using wildcards.

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [March 31, 2025, 7:13pm UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336/5 "2025-03-31T19:13:33Z")

</div>

example .this Document has the country of PL, i want to free text search for all documents from PL. 0 reults come back . Note all fields are keywords as these are datastreams from ZIA integration

even with wildcards nothing.

 ![Screenshot 2025-03-31 151422](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4b9de7e7f3bf68437c737579b765f8001e8ea956.png)

 ![Screenshot 2025-03-31 151317](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96770c401642ab0f8f7e12cdbf72ce8aa3248265.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 31, 2025, 7:35pm UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336/6 "2025-03-31T19:35:19Z")

</div>

Yeah, this should work, elasticsearch would search for the string `PL` in all fields and return documents where at least one fields matches it.

Which version are you? Are you on Elastic Cloud or On-premises?

Can you share the settings fro that specific index? Just go into Kibana \> Stack Management \> Index Management \> Data Streams.

Select the Zscaler data stream and click on one of the backing indices and then on the Settings tab to see the settings being applied.