# Queries with fields {...} don't return field with dot in their name **URL:** \ **Category:** Elasticsearch\ **Created:** [July 1, 2014, 2:56pm UTC](https://discuss.elastic.co/t/queries-with-fields-dont-return-field-with-dot-in-their-name/18418 "2014-07-01T14:56:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![benq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benq/32/1428_2.png) [@benq](https://discuss.elastic.co/u/benq)\ **Post date:** [July 1, 2014, 2:56pm UTC](https://discuss.elastic.co/t/queries-with-fields-dont-return-field-with-dot-in-their-name/18418/1 "2014-07-01T14:56:53Z")
Hi all, I have a query that specify the fields to be returned as described here: [http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-request-fields.html](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-request-fields.html) However, it does not return the fields with a dot in their name, like "response.user". For example, Ex: { "size": 1000, "fields": ["@timestamp", "request", "response", "response.user", "clientip"], "query": {"match\_all": {} }, "filter": { "and": [ { "range": { "@timestamp": { "from": ... ``` ] ``` } } The timestamp, request, response and clientip fields are returned. The response.user is not. Any idea why? Regards, Benoît -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![vineeth\_mohan\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vineeth_mohan_2/32/747_2.png) [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\ **Post date:** [July 1, 2014, 5:17pm UTC](https://discuss.elastic.co/t/queries-with-fields-dont-return-field-with-dot-in-their-name/18418/2 "2014-07-01T17:17:27Z")
Hello Ben , Can you paste a sample feed. Thanks Vineeth On Tue, Jul 1, 2014 at 8:26 PM, benq [benoit.quartier@gmail.com](mailto:benoit.quartier@gmail.com) wrote: > Hi all, > > I have a query that specify the fields to be returned as described here: > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-request-fields.html) > However, it does not return the fields with a dot in their name, like > "response.user". > > For example, > Ex: > { > "size": 1000, > "fields": ["@timestamp", "request", "response", "response.user", > "clientip"], > "query": {"match\_all": {} }, > "filter": { > "and": [ > { "range": { "@timestamp": { "from": ... > > ``` > ] > > ``` > > } > } > > The timestamp, request, response and clientip fields are returned. The > response.user is not. > > Any idea why? > > Regards, > Benoît > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGdPd5m%2BapqyKN7fQzhH%3DX%2B4Vn\_s7Pd5Lso102oZb%3Du9F128nw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5m%2BapqyKN7fQzhH%3DX%2B4Vn_s7Pd5Lso102oZb%3Du9F128nw%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![benq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benq/32/1428_2.png) [@benq](https://discuss.elastic.co/u/benq)\ **Post date:** [July 2, 2014, 7:43am UTC](https://discuss.elastic.co/t/queries-with-fields-dont-return-field-with-dot-in-their-name/18418/3 "2014-07-02T07:43:07Z")
Hello Vineeth, the items that are indexed in elasticsearch really contains a field named "response.user". "\_source": { "clientip": "aaa.bbb.cccc.ddd", ``` "request": "http://aaaa.aa/bbbbb/ccccc", ``` "request.accept-encoding": "gzip, deflate", "request.accept-language": "de-ch", "response.content-type": "text/html; charset=UTF-8", ``` "response": 200, ``` "response.age": "0", "response.user": "userAAA", "@timestamp": "2014-07-01T12:18:51.501+02:00", } I realize there is an ambiguity between a field with a dot in its name and a field of a child document. Should fields with dot in their name be avoided? Benoît Le mardi 1 juillet 2014 19:17:41 UTC+2, vineeth mohan a écrit : > Hello Ben , > > Can you paste a sample feed. > > Thanks > Vineeth > > On Tue, Jul 1, 2014 at 8:26 PM, benq \<[benoit....@gmail.com](mailto:benoit....@gmail.com) \\> > wrote: > > > Hi all, > > > > I have a query that specify the fields to be returned as described here: > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-request-fields.html) > > However, it does not return the fields with a dot in their name, like > > "response.user". > > > > For example, > > Ex: > > { > > "size": 1000, > > "fields": ["@timestamp", "request", "response", "response.user", > > "clientip"], > > "query": {"match\_all": {} }, > > "filter": { > > "and": [ > > { "range": { "@timestamp": { "from": ... > > > > ``` > > ] > > > > ``` > > > > } > > } > > > > The timestamp, request, response and clientip fields are returned. The > > response.user is not. > > > > Any idea why? > > > > Regards, > > Benoît > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/86f48242-6514-4d4b-9809-362e18af1d95%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/86f48242-6514-4d4b-9809-362e18af1d95%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![vineeth\_mohan\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vineeth_mohan_2/32/747_2.png) [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\ **Post date:** [July 2, 2014, 2:53pm UTC](https://discuss.elastic.co/t/queries-with-fields-dont-return-field-with-dot-in-their-name/18418/4 "2014-07-02T14:53:56Z")
Hello Ben , This is defenitely an ambiguity. By request.user , in the usual case ES expects a data like "request" : { "user" : "vm" } Try "request.user" or something. Some mechanism to escape the dot. Thanks Vineeth On Wed, Jul 2, 2014 at 1:13 PM, benq [benoit.quartier@gmail.com](mailto:benoit.quartier@gmail.com) wrote: > Hello Vineeth, > > the items that are indexed in elasticsearch really contains a field named > "response.user". > > "\_source": { > "clientip": "aaa.bbb.cccc.ddd", > > ``` > "request": "http://aaaa.aa/bbbbb/ccccc", > > ``` > > "request.accept-encoding": "gzip, deflate", "request.accept-language": > "de-ch", "response.content-type": "text/html; charset=UTF-8", > > ``` > "response": 200, > > ``` > > "response.age": "0", "response.user": "userAAA", "@timestamp": > "2014-07-01T12:18:51.501+02:00", } > > I realize there is an ambiguity between a field with a dot in its name and > a field of a child document. Should fields with dot in their name be > avoided? > > Benoît > > Le mardi 1 juillet 2014 19:17:41 UTC+2, vineeth mohan a écrit : > > > Hello Ben , > > > > Can you paste a sample feed. > > > > Thanks > > Vineeth > > > > On Tue, Jul 1, 2014 at 8:26 PM, benq [benoit....@gmail.com](mailto:benoit....@gmail.com) wrote: > > > > > Hi all, > > > > > > I have a query that specify the fields to be returned as described here: > > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/) > > > current/search-request-fields.html > > > However, it does not return the fields with a dot in their name, like > > > "response.user". > > > > > > For example, > > > Ex: > > > { > > > "size": 1000, > > > "fields": ["@timestamp", "request", "response", "response.user", > > > "clientip"], > > > "query": {"match\_all": {} }, > > > "filter": { > > > "and": [ > > > { "range": { "@timestamp": { "from": ... > > > > > > ``` > > > ] > > > > > > ``` > > > > > > } > > > } > > > > > > The timestamp, request, response and clientip fields are returned. The > > > response.user is not. > > > > > > Any idea why? > > > > > > Regards, > > > Benoît > > > > > > -- > > > You received this message because you are subscribed to the Google > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/) > > > msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5% > > > [40googlegroups.com](http://40googlegroups.com) > > > [https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/cc08476f-0c6e-47bc-870a-2008386636c5%40googlegroups.com?utm_medium=email&utm_source=footer) > > > . > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/86f48242-6514-4d4b-9809-362e18af1d95%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/86f48242-6514-4d4b-9809-362e18af1d95%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/86f48242-6514-4d4b-9809-362e18af1d95%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/86f48242-6514-4d4b-9809-362e18af1d95%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGdPd5keeKB99M4rh1rKX74%3D0P%3DUqEEZtWVi0sq5-PYwY4WbKg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5keeKB99M4rh1rKX74%3D0P%3DUqEEZtWVi0sq5-PYwY4WbKg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:18am UTC](https://discuss.elastic.co/t/queries-with-fields-dont-return-field-with-dot-in-their-name/18418/5 "2017-07-06T01:18:20Z")