# Field \\"message\\" was indexed without position data; cannot run PhraseQuery **URL:** \ **Category:** Elasticsearch\ **Created:** [November 5, 2015, 5:32pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901 "2015-11-05T17:32:56Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![PavelPolyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavelpolyakov/32/44810_2.png) [@PavelPolyakov](https://discuss.elastic.co/u/PavelPolyakov)\ **Post date:** [November 5, 2015, 5:32pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/1 "2015-11-05T17:32:56Z")
Hi, I have an ELK configuration, which works pretty good, however, when I do some queries like this: ```auto message:"text with spaces" ``` I receive the next error: ```auto field \"message\" was indexed without position data; cannot run PhraseQuery ``` These kind of queries would not raise an errors: ```auto message:Storing the user information OR message:"login_ok" ``` Here is the mapping: ```auto "message": { "store": true, "type": "string" }, ``` Any thoughts? Regards, ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [November 5, 2015, 6:31pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/2 "2015-11-05T18:31:45Z")
You need to enable term positions, which are disabled by default: [https://www.elastic.co/guide/en/elasticsearch/reference/current/term-vector.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/term-vector.html) If you enable positions, then term frequencies are also enabled, which is generally the desired behavior, but sometimes not. Ivan ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [November 5, 2015, 6:46pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/3 "2015-11-05T18:46:11Z")
What @Ivan suggests will work, but it will be a storage and performance hit to Elasticsearch if you change that. Are you trying to search for _exact_ text? Or just certain words? If you have not overridden the default template management, or indexed to names other than `logstash-YYYY.MM.DD`, then you can do exact text searches with the `message.raw` field. ---
**Author:** ![PavelPolyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavelpolyakov/32/44810_2.png) [@PavelPolyakov](https://discuss.elastic.co/u/PavelPolyakov)\ **Post date:** [November 5, 2015, 7:52pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/4 "2015-11-05T19:52:45Z")
@ivan Thanks, updated the template. @theuntergeek Thanks for the hint, however my template is updated and \*.raw is not there anymore. As amount of data is not big, I would go with indexing the positions and offsets. Regards, ---
**Author:** ![PavelPolyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavelpolyakov/32/44810_2.png) [@PavelPolyakov](https://discuss.elastic.co/u/PavelPolyakov)\ **Post date:** [November 6, 2015, 9:43am UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/5 "2015-11-06T09:43:50Z")
@Ivan Should it take effect immediately, after the new index would be created? My current mapping is the next: ```auto "message" : { "term_vector" : "with_positions_offsets", "index" : "analyzed", "store" : true, "type" : "string" } ``` However, when I do the same search using Kibana, within the timeframe "last 15 minutes", I receive the same error: 1. ```auto Courier Fetch: 20 of 920 shards failed. ``` 1. ```auto "reason": "QueryPhaseExecutionException[[logstash-2015.11.06][5]: query[filtered((message:\"starting the new registration process\"))->BooleanFilter(+cache(@timestamp:[1446801679498 TO 1446802579498]))],from[0],size[2500],sort[!]: Query Failed [Failed to execute main query]]; nested: IllegalStateException[field \"message\" was indexed without position data; cannot run PhraseQuery (term=starting)]; " ``` Should it work? Or it will start to work only when the old "indexes" would be removed? Regards, ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [November 6, 2015, 2:26pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/6 "2015-11-06T14:26:31Z")
The next new index is necessary. The mapping for `message` on the current index is already fixed. ---
**Author:** ![PavelPolyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavelpolyakov/32/44810_2.png) [@PavelPolyakov](https://discuss.elastic.co/u/PavelPolyakov)\ **Post date:** [November 6, 2015, 2:58pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/7 "2015-11-06T14:58:02Z")
Sorry, still didn't got it. I have updated the mapping yesterday, and tried to search "today" - within the interval of 15 minutes, so, in theory it should search by the new mapping. However, the search was not done. The index is already "new", but the error is the same. ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [November 6, 2015, 5:16pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/8 "2015-11-06T17:16:03Z")
I am not a Kibana user, can you try executing the query directly against the cluster? Are you using time based indices and is the query against all indices? Double check the mapping using the API, not by what you think you might have used. Ivan ---
**Author:** ![softwaredoug](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/softwaredoug/32/22681_2.png) [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)\ **Post date:** [November 7, 2015, 4:28pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/9 "2015-11-07T16:28:16Z")
There's a difference between [term vectors with positions](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-termvectors.html) and just enabling [term frequencies and positions](https://www.elastic.co/guide/en/elasticsearch/reference/2.0/index-options.html). ie setting `positions: false` in your mapping would make phrase queries not work. Term vectors are another, unrelated data structure that keep an uninverted (ie regular looking) view of the documents used in various advanced applications of Elasticsearch. ---
**Author:** ![PavelPolyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavelpolyakov/32/44810_2.png) [@PavelPolyakov](https://discuss.elastic.co/u/PavelPolyakov)\ **Post date:** [November 8, 2015, 1:15pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/10 "2015-11-08T13:15:01Z")
Sorry, I'm not quite sure that I understood. Could you say, in particular, should this mapping: > [@PavelPolyakov](#): > > "message" : { > "term\_vector" : "with\_positions\_offsets", > "index" : "analyzed", > "store" : true, > "type" : "string" > } Solve the ```auto field \"message\" was indexed without position data; ``` issue? Or I should put the `term_vector` option to the different value? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:39pm UTC](https://discuss.elastic.co/t/field-message-was-indexed-without-position-data-cannot-run-phrasequery/33901/11 "2017-07-05T23:39:57Z")