# Mapper Attachment Plugin

**URL:** <https://discuss.elastic.co/t/mapper-attachment-plugin/70160>\
**Category:** Elasticsearch\
**Created:** [December 28, 2016, 8:40pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160 "2016-12-28T20:40:47Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 28, 2016, 8:40pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/1 "2016-12-28T20:40:47Z")

</div>

I've installed the mapper attachment plugin and have been loading different types of attachments and have been doing searches on words that are in the attachment content. It seems to work fine for .txt, .doc, .rtf, .pdf However, I can't get it to find content in .xlsx or .ppt files.

Using Sense, I can see that the .xlsx and .ppt files were loaded, but the query is not returning any results when I search for words that are in these attachments. Any ideas?

This is an example of my query:

GET /test/attachment/\_search  
{  
"fields": [],  
"query": {  
"match": {  
"file.content": "float"  
}  
},  
"highlight": {  
"fields": {  
"file.content": {  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 28, 2016, 9:32pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/2 "2016-12-28T21:32:29Z")

</div>

If you stored the content field, can you show its content so we know what has been extracted?

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 28, 2016, 9:46pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/3 "2016-12-28T21:46:29Z")

</div>

I've placed the file in an attachment. It exceeded the reply to character max. It may be too small to be helpful. I can email the text if you'd like.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a4be3ed4637e920f340efda64f7ec50a8a11ef5a.PNG)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 28, 2016, 9:59pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/4 "2016-12-28T21:59:02Z")

</div>

No I meant something like \_search?fields=file.content

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 28, 2016, 11:02pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/5 "2016-12-28T23:02:49Z")

</div>

when I do a search for content like this..  
GET /test/attachment/\_search?fields=file.content  
{

}

This is the result. Does this mean there was an issue loading the content?  
{  
"took": 3,  
"timed\_out": false,  
"\_shards": {  
"total": 5,  
"successful": 5,  
"failed": 0  
},  
"hits": {  
"total": 1,  
"max\_score": 1,  
"hits": [  
{  
"\_index": "test",  
"\_type": "attachment",  
"\_id": "54881",  
"\_score": 1  
}  
]  
}  
}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 29, 2016, 4:40am UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/6 "2016-12-29T04:40:33Z")

</div>

Can you confirm that you can see content from other documents?

If not, it probably means that you did not change the mapping to store the field.

If you can see the content for other docs, then it means that indeed something went wrong at index time.

LMK

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 29, 2016, 12:53pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/7 "2016-12-29T12:53:17Z")

</div>

I can see the content for other types of attachments. How can I troubleshoot the failure to load the content for the .xlsx and .ppt files? I'm basically taking an inputstream of the attachment content and encoding it with base64 and storing it as a string.

```
		// Encode attachment content using basic encoder
		byte[] bytes = IOUtils.toByteArray(inputStream);
		String base64encodedString = Base64.getEncoder().encodeToString(bytes);
```

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 29, 2016, 1:21pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/8 "2016-12-29T13:21:40Z")

</div>

I turned on ignore errors to false and I see this error now when loading .xlsx files.

{"error":  
{"root\_cause":[  
{"type":"mapper\_parsing\_exception","reason":"Failed to extract [-1] characters of text for [null] :  
Could not initialize class org.apache.poi.POIXMLProperties"}],  
"type":"mapper\_parsing\_exception","reason":"Failed to extract [-1] characters of text for [null] :  
Could not initialize class org.apache.poi.POIXMLProperties","caused\_by":{"type":"no\_class\_def\_found\_error","reason":"Could not initialize class org.apache.poi.POIXMLProperties"}},  
"status":400}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 29, 2016, 1:22pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/9 "2016-12-29T13:22:43Z")

</div>

Great. Can you share your file?

Even privately at david at elastic dot co and I'll give a look next week.

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 29, 2016, 1:28pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/10 "2016-12-29T13:28:59Z")

</div>

Thanks! I just send an email with my .xlsx attachment. I'll continue to troubleshoot on my end as well.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 29, 2016, 2:13pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/11 "2016-12-29T14:13:28Z")

</div>

Great!

Can you open an issue with that trace?  
And link to this thread in the issue?

I think we are missing a library here. I hope we can fix it if we don't have jar hell issues.

Thanks a lot for investigating!

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 29, 2016, 2:15pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/12 "2016-12-29T14:15:48Z")

</div>

Sure! I'm actually trying to mess with jars right now. I'll open up a new issue and link it.

Thanks!

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 29, 2016, 2:33pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/13 "2016-12-29T14:33:59Z")

</div>

I meant open an issue in GitHub not on discuss 🙂

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 29, 2016, 2:34pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/14 "2016-12-29T14:34:51Z")

</div>

Oh, ok. Sure!

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 29, 2016, 2:40pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/15 "2016-12-29T14:40:31Z")

</div>

I created an issue on GitHub here:

> <https://github.com/bdevaca/hello-world/issues/1>

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 29, 2016, 4:37pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/16 "2016-12-29T16:37:46Z")

</div>

I meant in elasticsearch repository where the project and the plugin is living.

So here:

> **[Build software better, together](https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Felastic%2Felasticsearch%2Fissues%2Fnew)**
>
> GitHub is where people build software. More than 27 million people use GitHub to discover, fork, and contribute to over 76 million projects.

---

<div class="post-metadata">

**Author:** ![bdevaca](https://avatars.discourse-cdn.com/v4/letter/b/b9bd4f/32.png) [@bdevaca](https://discuss.elastic.co/u/bdevaca)\
**Post date:** [December 29, 2016, 4:45pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/17 "2016-12-29T16:45:53Z")

</div>

Ok. I think I got it this time. I'm not sure how to link it to this issue but here is the url:

> <https://github.com/elastic/elasticsearch/issues/22369>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 26, 2017, 4:45pm UTC](https://discuss.elastic.co/t/mapper-attachment-plugin/70160/18 "2017-01-26T16:45:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
