# Need help retrieving field from ES **URL:** \ **Category:** Elasticsearch\ **Created:** [December 23, 2013, 8:40pm UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005 "2013-12-23T20:40:17Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Nick\_Toseland](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Nick\_Toseland](https://discuss.elastic.co/u/Nick_Toseland)\ **Post date:** [December 23, 2013, 8:40pm UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/1 "2013-12-23T20:40:17Z")
Hi All I am new to ElasticSearch, please forgive my stupidity. I cant seem to get the keepalive field out of ES. { "\_index" : "lj-2013122320", "\_type" : "varnish", "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", "\_score" : 1.0 } I can get other field out of it cdn: { "\_index" : "2013122320", "\_type" : "log", "\_id" : "2neLlVNKQCmXq6etTE6Kcw", "\_score" : 1.0, "fields" : { "cdn" : "-" } } The mapping is there: {"log":{"\_timestamp":{"enabled":true,"store":true},"properties": {"keepalive":{"type":"integer"}}}} Any help is much appreciated. Thanks in advance Nick -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/ee76e0af-4e64-430e-89f7-463dea1acfed%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/ee76e0af-4e64-430e-89f7-463dea1acfed%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Karol\_Gwaj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karol_gwaj/32/1324_2.png) [@Karol\_Gwaj](https://discuss.elastic.co/u/Karol_Gwaj)\ **Post date:** [December 24, 2013, 2:27am UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/2 "2013-12-24T02:27:38Z")
keepalive field is stored in \_source field (if you want to store it separately you have to add "store" : true to mapping) hard to tell more based on your example, also maybe you disabled \_source field completely? On Monday, December 23, 2013 8:40:17 PM UTC, Nick Toseland wrote: > Hi All > > I am new to Elasticsearch, please forgive my stupidity. > > I cant seem to get the keepalive field out of ES. > > { > "\_index" : "lj-2013122320", > "\_type" : "varnish", > "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", > "\_score" : 1.0 > } > > I can get other field out of it cdn: > > { > "\_index" : "2013122320", > "\_type" : "log", > "\_id" : "2neLlVNKQCmXq6etTE6Kcw", > "\_score" : 1.0, > "fields" : { > "cdn" : "-" > } > } > > The mapping is there: > > {"log":{"\_timestamp":{"enabled":true,"store":true},"properties": > {"keepalive":{"type":"integer"}}}} > > Any help is much appreciated. > > Thanks in advance > > Nick -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4ddd4df2-b2f6-4a3f-8ff5-5a0196f389d7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4ddd4df2-b2f6-4a3f-8ff5-5a0196f389d7%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Nick\_Toseland](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Nick\_Toseland](https://discuss.elastic.co/u/Nick_Toseland)\ **Post date:** [December 24, 2013, 11:58am UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/3 "2013-12-24T11:58:05Z")
Hi Karol Thanks for the reply. We have been left this ES setup by a previous member of staff. We create new Indexes every hour using the following the following perl statement Are you saying I have to add store =\> yes to keepalive? We don't do that for the other as you can see? create\_index( index =\> $index, settings =\> { \_timestamp =\> { enabled =\> 1, store =\> 1 }, number\_of\_shards =\> 3, number\_of\_replicas =\> 1, }, mappings =\> { varnish =\> { \_timestamp =\> { enabled =\> 1, store =\> 1 }, properties =\> { content\_length =\> { type =\> 'integer' }, age =\> { type =\> 'integer' }, keepalive =\> { type =\> 'integer' }, resp\_time =\> { type =\> 'float' }, host =\> { type =\> 'string', index =\> 'not\_analyzed' }, time =\> { type =\> 'string', store =\> 'yes' }, location =\> { type =\> 'string', index =\> 'not\_analyzed' }, addr =\> { fields =\> { ip =\> { type =\> 'ip' }, addr =\> { type =\> 'string', index =\> 'not\_analyzed' }, } }, } } }, ); I would no if the \_source field has been disabled, how do I check? Does this help more: { \_index: 2013122312 \_type: log \_id: Juh\_YQJaT4GQ8Pjwk1bnqw \_score: 1 \_source: { protocol: HTTP/1.0 cdn: - vary: Accept-Encoding,ETag browser: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.1) GeckaSeka/20090911 Firefox/3.5.1 encoding: - location: - geo: US ref: - origin: - cookie: - uri: / cache\_control: - content\_length: 54053 userid: 0 age: 11556 resp\_time: 0.000110149 method: GET accept: - ssl: 0 response\_code: 200 accept\_language: - varnstat: hit \_src: log addr: 41.5.97.6 } } Do you need anymore information to help? Thanks again Nick On Tue, Dec 24, 2013 at 2:27 AM, Karol Gwaj [karol@gwaj.me](mailto:karol@gwaj.me) wrote: > keepalive field is stored in \_source field (if you want to store it > separately you have to add "store" : true to mapping) > hard to tell more based on your example, > also maybe you disabled \_source field completely? > > On Monday, December 23, 2013 8:40:17 PM UTC, Nick Toseland wrote: > > > Hi All > > > > I am new to Elasticsearch, please forgive my stupidity. > > > > I cant seem to get the keepalive field out of ES. > > > > { > > "\_index" : "lj-2013122320", > > "\_type" : "varnish", > > "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", > > "\_score" : 1.0 > > } > > > > I can get other field out of it cdn: > > > > { > > "\_index" : "2013122320", > > "\_type" : "log", > > "\_id" : "2neLlVNKQCmXq6etTE6Kcw", > > "\_score" : 1.0, > > "fields" : { > > "cdn" : "-" > > } > > } > > > > The mapping is there: > > > > {"log":{"\_timestamp":{"enabled":true,"store":true},"properties": > > {"keepalive":{"type":"integer"}}}} > > > > Any help is much appreciated. > > > > Thanks in advance > > > > Nick > > > > -- > > You received this message because you are subscribed to a topic in the > > Google Groups "elasticsearch" group. > > To unsubscribe from this topic, visit > > [https://groups.google.com/d/topic/elasticsearch/roVCeLImQxs/unsubscribe](https://groups.google.com/d/topic/elasticsearch/roVCeLImQxs/unsubscribe). > > To unsubscribe from this group and all its topics, send an email to > > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/4ddd4df2-b2f6-4a3f-8ff5-5a0196f389d7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4ddd4df2-b2f6-4a3f-8ff5-5a0196f389d7%40googlegroups.com) > > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAMWL0yPqpG6H5gC58UWZHFodwOV14WM4P\_4LpovA\_mTB%3DDkG2A%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAMWL0yPqpG6H5gC58UWZHFodwOV14WM4P_4LpovA_mTB%3DDkG2A%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Nick\_Toseland](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Nick\_Toseland](https://discuss.elastic.co/u/Nick_Toseland)\ **Post date:** [January 2, 2014, 5:44pm UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/4 "2014-01-02T17:44:27Z")
Can anyone help me please? Many thanks On Monday, 23 December 2013 20:40:17 UTC, Nick Toseland wrote: > Hi All > > I am new to Elasticsearch, please forgive my stupidity. > > I cant seem to get the keepalive field out of ES. > > { > "\_index" : "lj-2013122320", > "\_type" : "varnish", > "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", > "\_score" : 1.0 > } > > I can get other field out of it cdn: > > { > "\_index" : "2013122320", > "\_type" : "log", > "\_id" : "2neLlVNKQCmXq6etTE6Kcw", > "\_score" : 1.0, > "fields" : { > "cdn" : "-" > } > } > > The mapping is there: > > {"log":{"\_timestamp":{"enabled":true,"store":true},"properties": > {"keepalive":{"type":"integer"}}}} > > Any help is much appreciated. > > Thanks in advance > > Nick -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 2, 2014, 7:32pm UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/5 "2014-01-02T19:32:22Z")
I think you will get more help if you follow what is explained here: [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/help/) Hard to help without more information. -- David 😉 Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs Le 2 janv. 2014 à 18:44, Nick Toseland [nick.toseland@gmail.com](mailto:nick.toseland@gmail.com) a écrit : > Can anyone help me please? > > Many thanks > > On Monday, 23 December 2013 20:40:17 UTC, Nick Toseland wrote: > > > Hi All > > > > I am new to Elasticsearch, please forgive my stupidity. > > > > I cant seem to get the keepalive field out of ES. > > > > { > > "\_index" : "lj-2013122320", > > "\_type" : "varnish", > > "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", > > "\_score" : 1.0 > > } > > > > I can get other field out of it cdn: > > > > { > > "\_index" : "2013122320", > > "\_type" : "log", > > "\_id" : "2neLlVNKQCmXq6etTE6Kcw", > > "\_score" : 1.0, > > "fields" : { > > "cdn" : "-" > > } > > } > > > > The mapping is there: > > > > {"log":{"\_timestamp":{"enabled":true,"store":true},"properties":{"keepalive":{"type":"integer"}}}} > > > > Any help is much appreciated. > > > > Thanks in advance > > > > Nick > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84%40googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/B21110F6-14E0-4301-AD38-0113086FC471%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/B21110F6-14E0-4301-AD38-0113086FC471%40pilato.fr). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Nick\_Toseland](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Nick\_Toseland](https://discuss.elastic.co/u/Nick_Toseland)\ **Post date:** [January 2, 2014, 8:35pm UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/6 "2014-01-02T20:35:42Z")
Thanks for the pointers David. I am using the Elasticsearch under Perl, to retrieve data based on facets, however the keepalive field is not returned. I guess this is because it is not in the \_source. However I can’t seem to get that field to appear. We create new indexes every hour, the last 24hours form an alias. I have created a gist with the search and the mapping from the index; here > Thanks again Nick On Thursday, 2 January 2014 19:32:22 UTC, David Pilato wrote: > I think you will get more help if you follow what is explained here: > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/help/) > > Hard to help without more information. > > -- > David 😉 > Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > > Le 2 janv. 2014 à 18:44, Nick Toseland \<[nick.t...@gmail.com](mailto:nick.t...@gmail.com) \\> > a écrit : > > Can anyone help me please? > > Many thanks > > On Monday, 23 December 2013 20:40:17 UTC, Nick Toseland wrote: > > > Hi All > > > > I am new to Elasticsearch, please forgive my stupidity. > > > > I cant seem to get the keepalive field out of ES. > > > > { > > "\_index" : "lj-2013122320", > > "\_type" : "varnish", > > "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", > > "\_score" : 1.0 > > } > > > > I can get other field out of it cdn: > > > > { > > "\_index" : "2013122320", > > "\_type" : "log", > > "\_id" : "2neLlVNKQCmXq6etTE6Kcw", > > "\_score" : 1.0, > > "fields" : { > > "cdn" : "-" > > } > > } > > > > The mapping is there: > > > > {"log":{"\_timestamp":{"enabled":true,"store":true},"properties": > > {"keepalive":{"type":"integer"}}}} > > > > Any help is much appreciated. > > > > Thanks in advance > > > > Nick > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84%40googlegroups.com) > > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/617940e3-1196-4bc5-b9df-dc97886e7001%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/617940e3-1196-4bc5-b9df-dc97886e7001%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [January 2, 2014, 8:45pm UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/7 "2014-01-02T20:45:46Z")
Judging by the one sample document, the keepalive field is not there. You can use the missing filter to see if any documents do have that field. For example: curl -XPOST localhost:9200/2014010119/\_count/ -d ' { "filtered": { "query": { "match\_all": {} }, "filter": { "not": { "filter": { "missing": { "field": "keepalive" } } } } } } ' -- Ivan On Thu, Jan 2, 2014 at 12:35 PM, Nick Toseland [nick.toseland@gmail.com](mailto:nick.toseland@gmail.com)wrote: > Thanks for the pointers David. > > I am using the Elasticsearch under Perl, to retrieve data based on > facets, however the keepalive field is not returned. I guess this is > because it is not in the \_source. However I can’t seem to get that field to > appear. > > We create new indexes every hour, the last 24hours form an alias. > > I have created a gist with the search and the mapping from the index; here > [ElasticSearch Field not returned/stored · GitHub](https://gist.github.com/nickt9999/8226220) > > Thanks again > > Nick > > On Thursday, 2 January 2014 19:32:22 UTC, David Pilato wrote: > > > I think you will get more help if you follow what is explained here: > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/help/) > > > > Hard to help without more information. > > > > -- > > David 😉 > > Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > > > > Le 2 janv. 2014 à 18:44, Nick Toseland [nick.t...@gmail.com](mailto:nick.t...@gmail.com) a écrit : > > > > Can anyone help me please? > > > > Many thanks > > > > On Monday, 23 December 2013 20:40:17 UTC, Nick Toseland wrote: > > > > > Hi All > > > > > > I am new to Elasticsearch, please forgive my stupidity. > > > > > > I cant seem to get the keepalive field out of ES. > > > > > > { > > > "\_index" : "lj-2013122320", > > > "\_type" : "varnish", > > > "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", > > > "\_score" : 1.0 > > > } > > > > > > I can get other field out of it cdn: > > > > > > { > > > "\_index" : "2013122320", > > > "\_type" : "log", > > > "\_id" : "2neLlVNKQCmXq6etTE6Kcw", > > > "\_score" : 1.0, > > > "fields" : { > > > "cdn" : "-" > > > } > > > } > > > > > > The mapping is there: > > > > > > {"log":{"\_timestamp":{"enabled":true,"store":true},"properties": > > > {"keepalive":{"type":"integer"}}}} > > > > > > Any help is much appreciated. > > > > > > Thanks in advance > > > > > > Nick > > > > > > -- > > > You received this message because you are subscribed to the Google Groups > > > "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send an > > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/) > > msgid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84% > > [40googlegroups.com](http://40googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/617940e3-1196-4bc5-b9df-dc97886e7001%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/617940e3-1196-4bc5-b9df-dc97886e7001%40googlegroups.com) > > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDMK%2BUuKW5XbRQMoT0XG\_VixhU%2BJAnFrcem\_dCvL4%3D5Cw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDMK%2BUuKW5XbRQMoT0XG_VixhU%2BJAnFrcem_dCvL4%3D5Cw%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Nick\_Toseland](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Nick\_Toseland](https://discuss.elastic.co/u/Nick_Toseland)\ **Post date:** [January 2, 2014, 9:28pm UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/8 "2014-01-02T21:28:27Z")
Ivan, That command confirms that no docs have the keepalive. My next silly question, is how do i get the field to appear? The mapping is there, are the options correct? Will the field appear when ES is loaded with data? Excuse my stupid questions, but I thought the field would be created if an index was created that had a mapping for keepalive. Thanks Nick On Thursday, 2 January 2014 20:45:46 UTC, Ivan Brusic wrote: > Judging by the one sample document, the keepalive field is not there. You > can use the missing filter to see if any documents do have that field. For > example: > > curl -XPOST localhost:9200/2014010119/\_count/ -d ' > { > "filtered": { > "query": { > "match\_all": {} > }, > "filter": { > "not": { > "filter": { > "missing": { > "field": "keepalive" > } > } > } > } > } > } > ' > > -- > Ivan > > On Thu, Jan 2, 2014 at 12:35 PM, Nick Toseland \<[nick.t...@gmail.com](mailto:nick.t...@gmail.com)\ > > > wrote: > > > Thanks for the pointers David. > > > > I am using the Elasticsearch under Perl, to retrieve data based on > > facets, however the keepalive field is not returned. I guess this is > > because it is not in the \_source. However I can’t seem to get that field to > > appear. > > > > We create new indexes every hour, the last 24hours form an alias. > > > > I have created a gist with the search and the mapping from the index; > > here [ElasticSearch Field not returned/stored · GitHub](https://gist.github.com/nickt9999/8226220) > > > > Thanks again > > > > Nick > > > > On Thursday, 2 January 2014 19:32:22 UTC, David Pilato wrote: > > > > > I think you will get more help if you follow what is explained here: > > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/help/) > > > > > > Hard to help without more information. > > > > > > -- > > > David 😉 > > > Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > > > > > > Le 2 janv. 2014 à 18:44, Nick Toseland [nick.t...@gmail.com](mailto:nick.t...@gmail.com) a écrit : > > > > > > Can anyone help me please? > > > > > > Many thanks > > > > > > On Monday, 23 December 2013 20:40:17 UTC, Nick Toseland wrote: > > > > > > > Hi All > > > > > > > > I am new to Elasticsearch, please forgive my stupidity. > > > > > > > > I cant seem to get the keepalive field out of ES. > > > > > > > > { > > > > "\_index" : "lj-2013122320", > > > > "\_type" : "varnish", > > > > "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", > > > > "\_score" : 1.0 > > > > } > > > > > > > > I can get other field out of it cdn: > > > > > > > > { > > > > "\_index" : "2013122320", > > > > "\_type" : "log", > > > > "\_id" : "2neLlVNKQCmXq6etTE6Kcw", > > > > "\_score" : 1.0, > > > > "fields" : { > > > > "cdn" : "-" > > > > } > > > > } > > > > > > > > The mapping is there: > > > > > > > > {"log":{"\_timestamp":{"enabled":true,"store":true},"properties": > > > > {"keepalive":{"type":"integer"}}}} > > > > > > > > Any help is much appreciated. > > > > > > > > Thanks in advance > > > > > > > > Nick > > > > > > > > -- > > > > You received this message because you are subscribed to the Google > > > > Groups "elasticsearch" group. > > > > To unsubscribe from this group and stop receiving emails from it, send > > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/) > > > msgid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84% > > > [40googlegroups.com](http://40googlegroups.com). > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > > > -- > > > You received this message because you are subscribed to the Google Groups > > > "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send an > > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > > To view this discussion on the web visit > > > [https://groups.google.com/d/msgid/elasticsearch/617940e3-1196-4bc5-b9df-dc97886e7001%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/617940e3-1196-4bc5-b9df-dc97886e7001%40googlegroups.com) > > > . > > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/24223a0b-7cb6-4a2b-8240-e633f6b80266%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/24223a0b-7cb6-4a2b-8240-e633f6b80266%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [January 2, 2014, 10:43pm UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/9 "2014-01-02T22:43:12Z")
Lucene (and therefore elasticsearch) is schemaless, so every document in the same index does not need to have the same structure. Just because the mapping contains the keepalive does not mean the document does. You can enforce that every field in the document must exist in the mapping [1], but not the inverse AFAIK. Something in your indexing process is not adding the keepalive field. You should double check that process first. Debug what is sent to elasticsearch during indexing. [1] > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. Cheers, Ivan On Thu, Jan 2, 2014 at 1:28 PM, Nick Toseland [nick.toseland@gmail.com](mailto:nick.toseland@gmail.com)wrote: > Ivan, > > That command confirms that no docs have the keepalive. > > My next silly question, is how do i get the field to appear? The mapping > is there, are the options correct? > Will the field appear when ES is loaded with data? > > Excuse my stupid questions, but I thought the field would be created if an > index was created that had a mapping for keepalive. > > Thanks > > Nick > > On Thursday, 2 January 2014 20:45:46 UTC, Ivan Brusic wrote: > > > Judging by the one sample document, the keepalive field is not there. You > > can use the missing filter to see if any documents do have that field. For > > example: > > > > curl -XPOST localhost:9200/2014010119/\_count/ -d ' > > { > > "filtered": { > > "query": { > > "match\_all": {} > > }, > > "filter": { > > "not": { > > "filter": { > > "missing": { > > "field": "keepalive" > > } > > } > > } > > } > > } > > } > > ' > > > > -- > > Ivan > > > > On Thu, Jan 2, 2014 at 12:35 PM, Nick Toseland [nick.t...@gmail.com](mailto:nick.t...@gmail.com)wrote: > > > > > Thanks for the pointers David. > > > > > > I am using the Elasticsearch under Perl, to retrieve data based on > > > facets, however the keepalive field is not returned. I guess this is > > > because it is not in the \_source. However I can’t seem to get that field to > > > appear. > > > > > > We create new indexes every hour, the last 24hours form an alias. > > > > > > I have created a gist with the search and the mapping from the index; > > > here [ElasticSearch Field not returned/stored · GitHub](https://gist.github.com/nickt9999/8226220) > > > > > > Thanks again > > > > > > Nick > > > > > > On Thursday, 2 January 2014 19:32:22 UTC, David Pilato wrote: > > > > > > > I think you will get more help if you follow what is explained here: > > > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/help/) > > > > > > > > Hard to help without more information. > > > > > > > > -- > > > > David 😉 > > > > Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > > > > > > > > Le 2 janv. 2014 à 18:44, Nick Toseland [nick.t...@gmail.com](mailto:nick.t...@gmail.com) a écrit : > > > > > > > > Can anyone help me please? > > > > > > > > Many thanks > > > > > > > > On Monday, 23 December 2013 20:40:17 UTC, Nick Toseland wrote: > > > > > > > > > Hi All > > > > > > > > > > I am new to Elasticsearch, please forgive my stupidity. > > > > > > > > > > I cant seem to get the keepalive field out of ES. > > > > > > > > > > { > > > > > "\_index" : "lj-2013122320", > > > > > "\_type" : "varnish", > > > > > "\_id" : "Y1M18ZItTDaap\_rOAS5YOA", > > > > > "\_score" : 1.0 > > > > > } > > > > > > > > > > I can get other field out of it cdn: > > > > > > > > > > { > > > > > "\_index" : "2013122320", > > > > > "\_type" : "log", > > > > > "\_id" : "2neLlVNKQCmXq6etTE6Kcw", > > > > > "\_score" : 1.0, > > > > > "fields" : { > > > > > "cdn" : "-" > > > > > } > > > > > } > > > > > > > > > > The mapping is there: > > > > > > > > > > {"log":{"\_timestamp":{"enabled":true,"store":true},"properties": > > > > > {"keepalive":{"type":"integer"}}}} > > > > > > > > > > Any help is much appreciated. > > > > > > > > > > Thanks in advance > > > > > > > > > > Nick > > > > > > > > > > -- > > > > > You received this message because you are subscribed to the Google > > > > > Groups "elasticsearch" group. > > > > > To unsubscribe from this group and stop receiving emails from it, send > > > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > > > > > > To view this discussion on the web visit [https://groups.google.com/d/ms](https://groups.google.com/d/ms) > > > > gid/elasticsearch/be2f3251-283c-4f7b-b5f6-09e807f7fe84%40goo > > > > [glegroups.com](http://glegroups.com). > > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > > > > > -- > > > > You received this message because you are subscribed to the Google > > > > Groups "elasticsearch" group. > > > > To unsubscribe from this group and stop receiving emails from it, send > > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/) > > > > msgid/elasticsearch/617940e3-1196-4bc5-b9df-dc97886e7001% > > > > [40googlegroups.com](http://40googlegroups.com). > > > > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/24223a0b-7cb6-4a2b-8240-e633f6b80266%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/24223a0b-7cb6-4a2b-8240-e633f6b80266%40googlegroups.com) > > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDWeinrMcY3%3Djm04xbqkyOZKx2zmSHduCb2GgKFQ2rpMQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDWeinrMcY3%3Djm04xbqkyOZKx2zmSHduCb2GgKFQ2rpMQ%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:58am UTC](https://discuss.elastic.co/t/need-help-retrieving-field-from-es/15005/10 "2017-07-06T01:58:35Z")