# Elasticsearch search does not return hits, Kibana does (5.x)

**URL:** <https://discuss.elastic.co/t/elasticsearch-search-does-not-return-hits-kibana-does-5-x/125631>\
**Category:** Elasticsearch\
**Created:** [March 26, 2018, 3:15pm UTC](https://discuss.elastic.co/t/elasticsearch-search-does-not-return-hits-kibana-does-5-x/125631 "2018-03-26T15:15:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mw\_jko](https://avatars.discourse-cdn.com/v4/letter/m/db5fbb/32.png) [@mw\_jko](https://discuss.elastic.co/u/mw_jko)\
**Post date:** [March 26, 2018, 3:15pm UTC](https://discuss.elastic.co/t/elasticsearch-search-does-not-return-hits-kibana-does-5-x/125631/1 "2018-03-26T15:15:42Z")

</div>

Hi,

I've got ~1.5mio entries in elasticsearch I need to delete/remove, because they caused some grokparseerrors.

Luckily they all have a tag (\_rubyexception and/or \_grokparsefailure) and I can do a nice kibana search to find the questionable entries. I also have a custom field for this (erroneousMessage)

The following **kibana** searches work for me:

```
tags:_rubyexception

```

or

```
_exists_:erroneousMessage

```

But, when I try searches using the search API (\_search or \_count) I have no luck (no hits).

Search for tags:

```
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "tags:_rubyexception",
            "analyze_wildcard": true
          }
        }
      ],
      "must_not": []
    }
  }
}

```

Search for field:

```
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "_exists_:erroneousMessage",
            "analyze_wildcard": true
          }
        }
      ],
      "must_not": []
    }
  }
}

```

(The queries are stripped down versions for the kibana "requests" you can display.)

I did some research and found it may be related to the fact that "tags" is "analyzed" and "erroneousMessage" is not a field included in the mapping (I create this on the fly when some error happens during the logstash parsing) - I still wonder:

1. Why am I successful with my search in kibana but not with the API? What is doing Kibana differently? I always thought of it as a fancy frontend for Elasticsearch but it seems it's "requests" are faked to some degree.
2. Is there any way for me to successfully query the results with my existing indexes/mapping so I can delete them via \_delete\_by\_query API?

---

<div class="post-metadata">

**Author:** ![mw\_jko](https://avatars.discourse-cdn.com/v4/letter/m/db5fbb/32.png) [@mw\_jko](https://discuss.elastic.co/u/mw_jko)\
**Post date:** [March 27, 2018, 12:54pm UTC](https://discuss.elastic.co/t/elasticsearch-search-does-not-return-hits-kibana-does-5-x/125631/2 "2018-03-27T12:54:18Z")

</div>

Sorry folks, my mistake and quite a simple solution:

I did the search on a limiting index pattern ("/myindex-2018\*/"), _but_ the erroneous entries are stored in a different index (because of the parse errors the date could not be extracted and an malformed index name was used). So the api search could not find anything in my /myindex-2018\*/ but Kibana does its searches in "/myindex\*/" (that's why it had hits).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2018, 12:54pm UTC](https://discuss.elastic.co/t/elasticsearch-search-does-not-return-hits-kibana-does-5-x/125631/3 "2018-04-24T12:54:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.