# Elasticsearch Query to fetch specific fields from the metricbeat index

**URL:** <https://discuss.elastic.co/t/elasticsearch-query-to-fetch-specific-fields-from-the-metricbeat-index/151420>\
**Category:** Elasticsearch\
**Created:** [October 8, 2018, 9:38am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-fetch-specific-fields-from-the-metricbeat-index/151420 "2018-10-08T09:38:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![r.ganeshbabu](https://avatars.discourse-cdn.com/v4/letter/r/4da419/32.png) [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\
**Post date:** [October 8, 2018, 9:38am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-fetch-specific-fields-from-the-metricbeat-index/151420/1 "2018-10-08T09:38:55Z")

</div>

Hi All,

I am using metricbeat to monitor the system metrics like cpu, process, memory etc.. and the data is sending to elasticsearch directly and I am trying to write elasticsearch query to fetch the specific fields from the metricbeat index and below is the query I tried,

```
GET metricbeat-2018.10.05/_search
{
  "_source": {
    "includes": [
      "@timestamp",
      "system.cpu.idle.pct"
    ]
  },
  "query": {
    "match_all": {}
  }
}

```

and below is the response from the query,

```
{
  "took": 7,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 1014212,
    "max_score": 1,
    "hits": [
      {
        "_index": "metricbeat-2018.10.05",
        "_type": "doc",
        "_id": "nJKXQ2YBcZrVnoszPvSG",
        "_score": 1,
        "_source": {
          "@timestamp": "2018-10-05T09:37:56.234Z"
        }
      },
      {
        "_index": "metricbeat-2018.10.05",
        "_type": "doc",
        "_id": "npKXQ2YBcZrVnoszPvSG",
        "_score": 1,
        "_source": {
          "@timestamp": "2018-10-05T09:37:56.234Z"
        }
      }

```

I am not sure why the **"system.cpu.idle.pct"** field is not showing in the output response. Though I checked the mapping of the index and I can see that there is **"no nested"** type for that fields and below is the mapping of the index,

```
  "system": {
    "properties": {
      "cpu": {
        "properties": {
          "cores": {
            "type": "long"
          },
          "idle": {
            "properties": {
              "pct": {
                "type": "long"
              }
            }
          }

```

How to get specific fields from the metricbeat index using es query?

Please let me know your thoughts and correct if i am doing anything wrong.

Regards,  
Ganeshbabu R

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2018, 9:38am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-fetch-specific-fields-from-the-metricbeat-index/151420/2 "2018-11-05T09:38:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.