# How to get only one field from elasticsearch in the output

**URL:** <https://discuss.elastic.co/t/how-to-get-only-one-field-from-elasticsearch-in-the-output/261379>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 18, 2021, 5:50am UTC](https://discuss.elastic.co/t/how-to-get-only-one-field-from-elasticsearch-in-the-output/261379 "2021-01-18T05:50:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![devil\_hacks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devil_hacks/32/82412_2.png) [@devil\_hacks](https://discuss.elastic.co/u/devil_hacks)\
**Post date:** [January 18, 2021, 5:50am UTC](https://discuss.elastic.co/t/how-to-get-only-one-field-from-elasticsearch-in-the-output/261379/1 "2021-01-18T05:50:42Z")

</div>

I am having my log data pushed into elasticssearch looks like given below:

```auto
{
     "took": 5,
   "timed_out": false,
   "_shards": {
       "total": 1,
       "successful": 1,
       "skipped": 0,
       "failed": 0
   },
   "hits": {
       "total": {
           "value": 1999,
           "relation": "eq"
       },
       "max_score": 1.0,
       "hits": [
           {
               "_index": "logstash-2021.01.13-000001",
               "_type": "_doc",
               "_id": "lVef-3YBI8ZVMz0vOphU",
               "_score": 1.0,
               "_source": {
                   "host": {
                       "name": "AAD-W1PF14DMMK"
                   },
                   "@timestamp": "2021-01-13T12:01:19.794Z",
                   "log": {
                       "file": {
                           "path": "C:\\elk\\test.log"
                       },
                       "offset": 158
                   },
                   "type": "test",
                   "tags": [
                       "beats_input_codec_plain_applied"
                   ],
                   "ecs": {
                       "version": "1.6.0"
                   },
                   "agent": {
                       "hostname": "AAD-W1PF14DMMK",
                       "type": "filebeat",
                       "name": "AAD-W1PF14DMMK",
                       "id": "4aa46436-264c-40ba-a24a-17af072c8363",
                       "version": "7.10.1",
                       "ephemeral_id": "18c7451e-78a8-4806-b43f-5ebae812b533"
                   },
                   "@version": "1",
                   "message": "2015-10-18 18:01:48,963 INFO [main] org.apache.hadoop.mapreduce.v2.app.MRAppMaster: Executing with tokens:"
               }
           },
}

```

I want to get output like

```auto
{ "message": "2015-10-18 18:01:48,963 INFO [main] org.apache.hadoop.mapreduce.v2.app.MRAppMaster: Executing with tokens:" }

```

I tried using

```auto
GET localhost:9200/_search?filter_path=hits.hits._source 
 {
    "_source": {
        "includes": ["message"]
    },
    "query": {
        "multi_match" : {
        "query": "ERROR",
        "fields": ["message"] 
        }
    }
}

```

It worked but giving warning that it will get deprecated by default.  
WARNING :

```auto
#! Deprecation: this request accesses system indices: [.apm-agent-configuration, .apm-custom-link, .async-search, .kibana_1, .kibana_task_manager_1], but in a future major version, direct access to system indices will be prevented by default

```

What would be the alternative solution??

---

<div class="post-metadata">

**Author:** ![William\_Brafford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/william_brafford/32/51559_2.png) [@William\_Brafford](https://discuss.elastic.co/u/William_Brafford)\
**Post date:** [January 19, 2021, 4:35pm UTC](https://discuss.elastic.co/t/how-to-get-only-one-field-from-elasticsearch-in-the-output/261379/2 "2021-01-19T16:35:27Z")

</div>

Right now your query is executing against every index, including indices that are used "behind the scenes" by various Elasticsearch components. The warning is telling you that in the future, those indices will not be available for search by default.

Fortunately, the data you are looking for is not in that sort of index. Instead of using the general search endpoint:

```auto
GET localhost:9200/_search

```

...try searching against an endpoint for your logstash indices only:

```auto
GET localhost:9200/logstash-*/_search?filter_path=hits.hits._source

```

This should return the results you are looking for without showing the deprecation warning.

---

<div class="post-metadata">

**Author:** ![devil\_hacks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devil_hacks/32/82412_2.png) [@devil\_hacks](https://discuss.elastic.co/u/devil_hacks)\
**Post date:** [January 30, 2021, 6:18pm UTC](https://discuss.elastic.co/t/how-to-get-only-one-field-from-elasticsearch-in-the-output/261379/3 "2021-01-30T18:18:41Z")

</div>

Thank you!  
Got my mistake!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2021, 6:18pm UTC](https://discuss.elastic.co/t/how-to-get-only-one-field-from-elasticsearch-in-the-output/261379/4 "2021-02-27T18:18:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.