# Input search query not fetching custom index details

**URL:** <https://discuss.elastic.co/t/input-search-query-not-fetching-custom-index-details/154375>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 29, 2018, 5:25am UTC](https://discuss.elastic.co/t/input-search-query-not-fetching-custom-index-details/154375 "2018-10-29T05:25:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gautu7](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gautu7](https://discuss.elastic.co/u/gautu7)\
**Post date:** [October 29, 2018, 5:25am UTC](https://discuss.elastic.co/t/input-search-query-not-fetching-custom-index-details/154375/1 "2018-10-29T05:25:56Z")

</div>

Hi,  
I am inserting a list of IDs into my custom index, when the watch executes every time who's result is a possible list of cluster IDs, I want to check if any of these IDs are present in the custom index in the last 24h. The insert is working as expected, when I try fetching the custom index details to check if it's present or not I get no hits back. I have inserted a timestamp value also into the payload since it's not present by default. What am I doing wrong here?

Here is how I am trying to fetch the last 24 hours data of the custom index

```
            {
                "second":{
                    "search":{
                        "request":{
                            "indices":"cluster-health-*",
                            "types":"cluster_id",
                            "body":{
                                "query": {
                                    "bool": {
                                      "filter": {
                                        "bool": {
                                          "must": [
                                            {
                                              "range": {
                                                "@timestamp": {
                                                  "gte": "now-24h"
                                                }
                                              }
                                            },
                                            {
                                              "term": {
                                                "type" : "cluster_id"
                                              }
                                            }
                                          ]
                                        }
                                      }
                                    }
                                }
                            }
                        }
                    }
                }
            }

```

Here is how my index looks like when I query it via the API

```
"hits": {
    "total": 9,
    "max_score": 1,
    "hits": [
      {
        "_index": "cluster-health-2018.10.29",
        "_type": "cluster_id",
        "_id": "-jUnvmYBSMovSiDEbIiW",
        "_score": 1,
        "_source": {
          "_value": [
            {
              "cluster_id": "abdsbdkd-ewtt",
              "@timestamp": "2018-10-29T04:49:06.234Z"
            }
          ]
        }
      },
      {
        "_index": "cluster-health-2018.10.29",
        "_type": "cluster_id",
        "_id": "cBwzvmYBABxtzd1Q1UW3",
        "_score": 1,
        "_source": {
          "_value": [
            {
              "cluster_id": "abdsbdkd-ewtt",
              "@timestamp": "2018-10-29T05:02:40.050Z"
            }
          ]
        }
      },
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 29, 2018, 9:58am UTC](https://discuss.elastic.co/t/input-search-query-not-fetching-custom-index-details/154375/2 "2018-10-29T09:58:51Z")

</div>

I am faily confident that your queries are not the same. The below query does not match any document in your sample result set, because there is no field named `type`, only one named `cluster_id`. You may want to refer to `_type` here.

> [@gautu7](#):
>
> "term": { "type" : "cluster\_id" }

--Alex

---

<div class="post-metadata">

**Author:** ![gautu7](https://avatars.discourse-cdn.com/v4/letter/g/c89c15/32.png) [@gautu7](https://discuss.elastic.co/u/gautu7)\
**Post date:** [October 29, 2018, 2:33pm UTC](https://discuss.elastic.co/t/input-search-query-not-fetching-custom-index-details/154375/3 "2018-10-29T14:33:07Z")

</div>

Thanks @spinscale  
It works when I use `_type` and get rid of the timestamp filter. I want to be able to query for a certain amount of time, can't we query for time range if it's inside the \_source \_value field like in my example above?

```
"bool": {
                                              "must": [
                                                {
                                                  "range": {
                                                    "@timestamp": {
                                                      "gte": "now-24h"
                                                    }
                                                  }
                                                },
                                                {
                                                  "term": {
                                                    "_type" : "cluster_id"
                                                  }
                                                }
                                              ]
                                            }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2018, 2:33pm UTC](https://discuss.elastic.co/t/input-search-query-not-fetching-custom-index-details/154375/4 "2018-11-26T14:33:08Z")

</div>

Closed on November 26, 2018, 2:33pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.