# How to query the index and only get specific indecies

**URL:** <https://discuss.elastic.co/t/how-to-query-the-index-and-only-get-specific-indecies/76445>\
**Category:** Logstash\
**Created:** [February 24, 2017, 8:43pm UTC](https://discuss.elastic.co/t/how-to-query-the-index-and-only-get-specific-indecies/76445 "2017-02-24T20:43:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ben\_Hoffman](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\
**Post date:** [February 24, 2017, 8:43pm UTC](https://discuss.elastic.co/t/how-to-query-the-index-and-only-get-specific-indecies/76445/1 "2017-02-24T20:43:48Z")

</div>

So I am querying my index like this right now:

```
{
"query": {
    "match_all" : { }
},
  "size": 1,
  "sort": [
{
 "@timestamp": {
     "order": "desc"
  }
  }
  ]
}

```

And I get the whole set of data, like you are supposed to with "match\_all". My question is how do you query only _specific_ fields in a event.

For example, if my fields in Kibana are like this:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/03bcfae0d71e6b5a4e27141d26e20d5bbea793fa.PNG)

Then How do I ONLY grab the "\_type" field in a HTTP query?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 25, 2017, 10:00pm UTC](https://discuss.elastic.co/t/how-to-query-the-index-and-only-get-specific-indecies/76445/2 "2017-02-25T22:00:49Z")

</div>

Check out [https://www.elastic.co/guide/en/elasticsearch/reference/5.2/search-request-source-filtering.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.2/search-request-source-filtering.html)

---

<div class="post-metadata">

**Author:** ![Ben\_Hoffman](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\
**Post date:** [February 27, 2017, 2:38pm UTC](https://discuss.elastic.co/t/how-to-query-the-index-and-only-get-specific-indecies/76445/3 "2017-02-27T14:38:46Z")

</div>

That worked, I also made a stack overflow post about this and got a [pretty good answer](http://stackoverflow.com/questions/42448454/how-to-query-logstash-via-curl-and-return-only-specific-fields/42448653?noredirect=1#comment72088126_42448653).

Here is my new query:

```
{
 "query": {
"match_all": { }
},
"size": 1,
"_source": {
    "includes": ["transport", "dest", "packet_source", "id_orig_p", "id_orig_p", "id_orig_h", "conn_state", "id_resp_h", "id_resp_p", "service", "proto"]
} ,
"sort": [
{
  "@timestamp": {
    "order": "desc"
  }
}
]
}

```

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2017, 2:38pm UTC](https://discuss.elastic.co/t/how-to-query-the-index-and-only-get-specific-indecies/76445/4 "2017-03-27T14:38:53Z")

</div>

Closed on March 27, 2017, 2:38pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.