# ELK6.8 vs Search on object/array elements

**URL:** https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291
**Category:** Kibana
**Created:** [February 25, 2022, 2:29pm UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291 "2022-02-25T14:29:37Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)
#### Post date: [February 25, 2022, 2:29pm UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291/1 "2022-02-25T14:29:37Z")

</div>

Got doc.s in a v.6.8 cluster looking like these:

 ![Screenshot 2022-02-25 at 15.20.03](https://us1.discourse-cdn.com/elastic/original/3X/1/5/15f899303cd580551ae1584c4153540b3844c025.png)

and are wondering how to discover/search for doc.s, which has a specific array element value.  
Say `logContext.processingIds[*]="some value"`  
as simple string search like `logContext.processingIds:"some value"` doesn't work.

TIA

---

<div class="post-metadata">

### Author: ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [March 1, 2022, 2:39pm UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291/2 "2022-03-01T14:39:23Z")

</div>

Hello @stefws

What is the mapping for the field? What does your query look like?

Thanks,  
Matt

---

<div class="post-metadata">

### Author: ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)
#### Post date: [March 3, 2022, 9:29pm UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291/3 "2022-03-03T21:29:50Z")

</div>

```auto
    "mappings" : {
      "systemlog" : {
        "_source" : {
          "enabled" : true
        },
        "properties" : {
          "hostName" : {
            "fielddata" : "true",
            "analyzer" : "ignore_lowercase",
            "type" : "text"
          },
          "longText" : {
            "fielddata" : "true",
            "analyzer" : "ignore_lowercase",
            "type" : "text"
          },
          "shortText" : {
            "fielddata" : "true",
            "analyzer" : "ignore_lowercase",
            "type" : "text"
          },
          "otherValues" : {
            "type" : "nested",
            "properties" : {
              "name" : {
                "fielddata" : "true",
                "analyzer" : "ignore_lowercase",
                "type" : "text"
              },
              "value" : {
                "fielddata" : "true",
                "analyzer" : "ignore_lowercase",
                "type" : "text"
              }
            }
          },
          "handled" : {
            "type" : "boolean"
          },
          "handledUser" : {
            "fielddata" : "true",
            "analyzer" : "ignore_lowercase",
            "type" : "text"
          },
          "logContext" : {
            "type" : "nested",
            "properties" : {
              "valueListId" : {
                "type" : "integer"
              },
              "routingId" : {
                "type" : "integer"
              },
              "docStoreFileId" : {
                "type" : "integer"
              },
              "processingIds" : {
                "fielddata" : "true",
                "analyzer" : "ignore_lowercase",
                "type" : "text"
              },
              "workAppId" : {
                "type" : "integer"
              },
              "specialFolderId" : {
                "type" : "integer"
              },
              "processConfigId" : {
                "type" : "integer"
              }
            }
          },
          "id" : {
            "fielddata" : "true",
            "analyzer" : "ignore_lowercase",
            "type" : "text"
          },
          "category" : {
            "fielddata" : "true",
            "analyzer" : "ignore_lowercase",
            "type" : "text"
          },
          "when" : {
            "type" : "date"
          },
          "value" : {
            "type" : "integer"
          }
        }
      }
    },

```

---

<div class="post-metadata">

### Author: ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [March 4, 2022, 1:22am UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291/4 "2022-03-04T01:22:14Z")

</div>

@stefws I think the problem is that you're trying to access data within nested fields - [Nested field type | Elasticsearch Guide [8.0] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/nested.html#nested-accessing-documents)

---

<div class="post-metadata">

### Author: ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)
#### Post date: [March 4, 2022, 7:11pm UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291/5 "2022-03-04T19:11:28Z")

</div>

Yes, correctly. Is this not supported in [Kibana until 7.6](https://discuss.elastic.co/t/visualizing-nested-objects-in-kibana/221617) or what?

---

<div class="post-metadata">

### Author: ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)
#### Post date: [March 5, 2022, 12:02am UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291/6 "2022-03-05T00:02:51Z")

</div>

@stefws Thats correct, although I'd do a test before you consider upgrading as nested field support is still incomplete.

---

<div class="post-metadata">

### Author: ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)
#### Post date: [March 6, 2022, 9:18am UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291/7 "2022-03-06T09:18:39Z")

</div>

Okay thanks, it's the plan to upgrade to v.7. soon anyway, so will properly have to wait for this before revisiting this. Remapping isn't an option as it's an embedded solution in an application. So we'll rather not tamper with mapping our self. Though we could dup indicies to our own custom and the remap data 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 3, 2022, 9:18am UTC](https://discuss.elastic.co/t/elk6-8-vs-search-on-object-array-elements/298291/8 "2022-04-03T09:18:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
