# Kibana and unknown JSON

**URL:** <https://discuss.elastic.co/t/kibana-and-unknown-json/101364>\
**Category:** Kibana\
**Created:** [September 21, 2017, 4:03pm UTC](https://discuss.elastic.co/t/kibana-and-unknown-json/101364 "2017-09-21T16:03:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dataminer](https://avatars.discourse-cdn.com/v4/letter/d/f9ae1b/32.png) [@dataminer](https://discuss.elastic.co/u/dataminer)\
**Post date:** [September 21, 2017, 4:03pm UTC](https://discuss.elastic.co/t/kibana-and-unknown-json/101364/1 "2017-09-21T16:03:22Z")

</div>

Okay - first time trying to play with kibana after weeks of trying to perfect mappings etc in ES and I am banging my head on the wall already 🙂

I have data in two fields, "meta" (contains known data eg meta.hashvalue etc) and data which contains unknown data from different sources of which I have no idea of what fields will be in there and a hash value (data.hash and data.content). The content could be string or a JSON object and have between 1 and 100 fields (probably using the wrong name with fields - sorry!).

So, I can get kibana to query on the meta.keyword field but when I want to query something in the data, I want to try and use a wildcard along the lines of ["data.content.\*"] but I am getting nothing back.

Is it possible to search using kibana and a the ["data.content.\*"] type query?

Thanks!

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [September 22, 2017, 9:47pm UTC](https://discuss.elastic.co/t/kibana-and-unknown-json/101364/2 "2017-09-22T21:47:54Z")

</div>

You will have to make sure that the mapping for that field is type `text`, which is not analyized and fullports full-text searching.

---

<div class="post-metadata">

**Author:** ![dataminer](https://avatars.discourse-cdn.com/v4/letter/d/f9ae1b/32.png) [@dataminer](https://discuss.elastic.co/u/dataminer)\
**Post date:** [September 25, 2017, 8:35am UTC](https://discuss.elastic.co/t/kibana-and-unknown-json/101364/3 "2017-09-25T08:35:34Z")

</div>

Thanks for that - I set it to text before but didn't specify 'not analyzed' etc  
Well, thats this mornings work then!

Thanks again

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2017, 8:35am UTC](https://discuss.elastic.co/t/kibana-and-unknown-json/101364/4 "2017-10-23T08:35:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.