# Many fields not searchable after upgrade

**URL:** <https://discuss.elastic.co/t/many-fields-not-searchable-after-upgrade/170177>\
**Category:** Kibana\
**Created:** [February 27, 2019, 1:43pm UTC](https://discuss.elastic.co/t/many-fields-not-searchable-after-upgrade/170177 "2019-02-27T13:43:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![leftorbit23](https://avatars.discourse-cdn.com/v4/letter/l/5f8ce5/32.png) [@leftorbit23](https://discuss.elastic.co/u/leftorbit23)\
**Post date:** [February 27, 2019, 1:43pm UTC](https://discuss.elastic.co/t/many-fields-not-searchable-after-upgrade/170177/1 "2019-02-27T13:43:23Z")

</div>

After upgrading to the latest version of Elasticsearch and Kibana many of my fields are not searchable using Discover.

Elasticsearch 6.6.1  
Kibana 6.6.1

Elasticsearch search indexes is managed by Graylog.

Example of a working field:

```
name: netflow_ipv4_src_addr
type: keyword

```

Example of a field that is not searchable:

```
name: asa_src_ip 
type: keyword

```

Even though the field is non searchable, when I enable "Turn on query features", it can see the field as well as field values for asa\_src\_ip

Both of these fields show up under the Index Patterns screen, and both of them are seen as type string, searchable and aggregatable.

Here is a stripped down Kibana query that works (netflow\_ipv4\_src\_addr):

```
GET _search
{
  "version": true,
  "size": 5,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": 1551268505824,
              "lte": 1551269405824,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "netflow_ipv4_src_addr": "8.8.8.8"
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ]
    }
  }
}

```

Here is a stripped down Kibana query that returns zero results (asa\_src\_ip):

```
GET _search
{
  "version": true,
  "size": 5,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": 1551268505824,
              "lte": 1551269405824,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "asa_src_ip": "8.8.8.8"
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ]
    }
  }
}

```

Here is a stripped down Graylog query that works (asa\_src\_ip):

```
GET _search
{
  "from": 0,
  "size": 5,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "asa_src_ip:8.8.8.8"

          }
        }
      ],
      "filter": [
        {
          "bool": {
            "must": [
              {
                "range": {
                  "timestamp": {
                    "from": "2019-02-27 12:14:27.187",
                    "to": "2019-02-27 12:19:27.187"
                  }
                }
              }
            ]

          }
        }
      ]
    }
  }
}

```

The to/from times are slightly different, but there should be 100+ search results in each one.

Reloading indexes didn't help. Any idea what could be causing some fields not to be searchable?

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 27, 2019, 8:38pm UTC](https://discuss.elastic.co/t/many-fields-not-searchable-after-upgrade/170177/2 "2019-02-27T20:38:39Z")

</div>

What is the Elasticsearhc-mapping of your index for those fields, both are keywords after the upgrade?

Keyword fields do require an exact match to return with match\_phrase. Is that IP-address stored exactly like the string `8.8.8.8`?

---

<div class="post-metadata">

**Author:** ![leftorbit23](https://avatars.discourse-cdn.com/v4/letter/l/5f8ce5/32.png) [@leftorbit23](https://discuss.elastic.co/u/leftorbit23)\
**Post date:** [February 27, 2019, 8:44pm UTC](https://discuss.elastic.co/t/many-fields-not-searchable-after-upgrade/170177/3 "2019-02-27T20:44:30Z")

</div>

Both are keywords.

IP is stored exactly like the string "8.8.8.8"

The "auto-complete" functionality in the search box "Turn on query features" can see both the field and the field value, but the search result comes up with "No results match your search criteria"

![image](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f31e0d18e74ed0e3bf4b93095645b63069bb72f3.png)

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a5e9f346c74be4599583d499464ba2a9a5588c7.png)

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 27, 2019, 9:10pm UTC](https://discuss.elastic.co/t/many-fields-not-searchable-after-upgrade/170177/4 "2019-02-27T21:10:13Z")

</div>

I would log this as a bug. If that query is not returning any results, the query-bar should not suggest this as a query option. [https://github.com/elastic/kibana/issues/new](https://github.com/elastic/kibana/issues/new)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2019, 9:10pm UTC](https://discuss.elastic.co/t/many-fields-not-searchable-after-upgrade/170177/5 "2019-03-27T21:10:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.