# Message field not searchable in container logs from Kubernetes integration

**URL:** <https://discuss.elastic.co/t/message-field-not-searchable-in-container-logs-from-kubernetes-integration/290443>\
**Category:** Kibana\
**Tags:** fleet, integrations\
**Created:** [November 29, 2021, 2:25pm UTC](https://discuss.elastic.co/t/message-field-not-searchable-in-container-logs-from-kubernetes-integration/290443 "2021-11-29T14:25:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nico\_Krijnen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nico_krijnen/32/1438_2.png) [@Nico\_Krijnen](https://discuss.elastic.co/u/Nico_Krijnen)\
**Post date:** [November 29, 2021, 2:25pm UTC](https://discuss.elastic.co/t/message-field-not-searchable-in-container-logs-from-kubernetes-integration/290443/1 "2021-11-29T14:25:28Z")

</div>

We are using Elatic Cloud to collect logs from a Kubernetes cluster using fleet-managed Elastic Agents.

When enabling the Kubernetes integration in a policy, the Agents automatically pick up container logs. That is really useful as that means all the logs from our apps flow into Elastic.

However, when searching I noticed I do not get any matches on individual words in the message field. Looking at the **index template** : **logs-kubernetes.container\_logs** , it has no mapping for the message field. The result is that the message field is mapped as " **keyword**" instead of "match\_only\_text".

Looking at the template from another integration (logs-system.system), that one includes the following in it's template:

```auto
    "message": {
      "type": "match_only_text"
    }

```

Question: is the message field omitted from the Kubernetes integration intentionally?

If not, would it make sense to add that?

Or would it be an idea to add the 'data-streams-mappings' managaged component templates as a component in the managed logs-kubernetes.container\_logs template? That component template includes a nice dynamic template that matches the message field and makes it match\_only\_text.

```auto
{
  "dynamic_templates": [
    ...
    {
      "match_message": {
        "mapping": {
          "type": "match_only_text"
        },
        "match_mapping_type": "string",
        "match": "message"
      }
    },
    ...

```

---

<div class="post-metadata">

**Author:** ![Nico\_Krijnen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nico_krijnen/32/1438_2.png) [@Nico\_Krijnen](https://discuss.elastic.co/u/Nico_Krijnen)\
**Post date:** [December 14, 2021, 11:10am UTC](https://discuss.elastic.co/t/message-field-not-searchable-in-container-logs-from-kubernetes-integration/290443/2 "2021-12-14T11:10:11Z")

</div>

I did some more digging and found the source for the kubernetes Fleet integration. The datastream definition does seem to mention the `message` field. Specifically with an `external: ecs` value.

> <https://github.com/elastic/integrations/blob/master/packages/kubernetes/data_stream/container_logs/fields/ecs.yml#L17>

The spec documentation seems to suggest that the field definition will be taken from the ecs field definitions. Although I haven't found the bit that implements that logic yet.

> <https://github.com/elastic/package-spec/blob/master/versions/1/data_stream/fields/fields.spec.yml#L89>

The definition of the `system.system` data\_stream seems to be identical, so I don't understand why that one is using `match_only_text` and the template for `kubernetes.container` does not have a definition for message and therefor falls back to the default `keyword`.

> <https://github.com/elastic/integrations/blob/5634dbf3f4150faabc0f64765fd5fa0d57e2825f/packages/system/data_stream/system/fields/ecs.yml#L27>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2022, 11:11am UTC](https://discuss.elastic.co/t/message-field-not-searchable-in-container-logs-from-kubernetes-integration/290443/3 "2022-01-11T11:11:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.