# Querying an Array of Strings for the 1st, 2nd and 3rd Element

**URL:** <https://discuss.elastic.co/t/querying-an-array-of-strings-for-the-1st-2nd-and-3rd-element/72208>\
**Category:** Elasticsearch\
**Created:** [January 19, 2017, 6:42pm UTC](https://discuss.elastic.co/t/querying-an-array-of-strings-for-the-1st-2nd-and-3rd-element/72208 "2017-01-19T18:42:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hostbrew](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hostbrew/32/14741_2.png) [@hostbrew](https://discuss.elastic.co/u/hostbrew)\
**Post date:** [January 19, 2017, 6:42pm UTC](https://discuss.elastic.co/t/querying-an-array-of-strings-for-the-1st-2nd-and-3rd-element/72208/1 "2017-01-19T18:42:57Z")

</div>

Hello elastic community,

I have an Array of Strings from a spam filter log;

```
spam_rules": [
   "KNOWN_SPAM_CONTENT",
   "KNOWN_SPAM_ZIPSIG",
   "KNOWN_SPAM_ZIPSIG_EXT",
   "RDNS_SUSP_SPAM",
   "ZIP_ATTACHED_WSF",
   "RDNS_SUSP_ZIP_ATTACHED",
   "INVOICE_ATTACHMENT",
   "HTML_00_01",
   "HTML_00_10",
   "ARCHIVE_ATTACHED",
   "BODYTEXTP_SIZE_3000_LESS",
   "FROM_SAME_AS_TO_DOMAIN",
   "NO_REAL_NAME",
   "NO_URI_HTTPS",
   "RDNS_GENERIC_POOLED",
   "RDNS_SUSP",
   "RDNS_SUSP_GENERIC",
   "ZIP_ATTACHED"
]

```

In this example "KNOWN\_SPAM\_CONTENT" has more weight than "KNOWN\_SPAM\_ZIPSIG", and so on down the array with the last value having the least weight.

I would like to be able to query the first, second and third values and visualize each individually to see what spam rule was see the most within the first, second and third element.

Upon reading the documentation I saw that multivalue field arrays are "a bag of values".  
"However, arrays are indexed—made searchable—as multivalue fields, which are unordered. At search time, you can’t refer to “the first element” or “the last element.” Rather, think of an array as a bag of values."  
[https://www.elastic.co/guide/en/elasticsearch/guide/master/complex-core-fields.html](https://www.elastic.co/guide/en/elasticsearch/guide/master/complex-core-fields.html)

I have the created the flowing mapping for spam\_rules

```
> "type": "text",
> "index_options": "positions",
> "fields": {
> "keyword": {
> "type": "keyword"

```

I had considered trying to create three new fields called spam\_rule1, spam\_rule2, and spam\_rule3 within logstash. This would be pretty simple to accomplish however I would rather pull the data from the array if possible.

I am pretty sure I need to write a painless script to visualize this data. However, I'd like to know if this is ultimately possible.

Logstash, Elasticsearch, Kibana are running version 5.1.2-1

Any suggestions or tips would be awesome!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2017, 6:43pm UTC](https://discuss.elastic.co/t/querying-an-array-of-strings-for-the-1st-2nd-and-3rd-element/72208/2 "2017-02-16T18:43:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.