# Genre syntax didn't return classification data

**URL:** <https://discuss.elastic.co/t/genre-syntax-didnt-return-classification-data/113940>\
**Category:** Elasticsearch\
**Created:** [January 3, 2018, 2:38pm UTC](https://discuss.elastic.co/t/genre-syntax-didnt-return-classification-data/113940 "2018-01-03T14:38:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [January 3, 2018, 2:38pm UTC](https://discuss.elastic.co/t/genre-syntax-didnt-return-classification-data/113940/1 "2018-01-03T14:38:36Z")

</div>

AS title my data index is:"ntopng-2018.01.02" this is my Restful API:

```
GET ntopng-2018.01.02/_search
{
"size" : 0,
"query": {
"bool": {
"should": [
{
    "term":{"IPV4_SRC_ADDR":"120.127.160.91"}
},
{
    "term":{"IPV4_DST_ADDR":"120.127.160.91"}
}
],"minimum_should_match": 1,
"must":[
{
  "range" : {
    "LAST_SWITCHED" : {
        "gte" : 1514800209
    }
  }
 }
]
}
 },
"aggs": {
"genres":{
 "terms" : {
        "field" : "L7_PROTO_NAME.keyword"  
    } ,
 "aggs":{
"in_bytes": {
"sum": { "field":"IN_BYTES"}
}
}
}
}
}

```

and the response:

```
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 6,
"successful": 6,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 282,
"max_score": 0,
"hits": []
},
"aggregations": {
"genres": {
  "doc_count_error_upper_bound": 0,
  "sum_other_doc_count": 0,
  "buckets": []
}
}
}

```

it didn't classify L7\_PROTO\_NAME, but if I change to another index"logstash-2018.01.02"(the same data type fields), it would return classified data. this is my data:[https://gist.github.com/Howard-Chang/808ed0f4c64c528051f284cee3ac0634](https://gist.github.com/Howard-Chang/808ed0f4c64c528051f284cee3ac0634)

thank you in advance 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2018, 2:38pm UTC](https://discuss.elastic.co/t/genre-syntax-didnt-return-classification-data/113940/2 "2018-01-31T14:38:38Z")

</div>

Closed on January 31, 2018, 2:38pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.