# Question About search in Kibana

**URL:** <https://discuss.elastic.co/t/question-about-search-in-kibana/252929>\
**Category:** Kibana\
**Created:** [October 22, 2020, 5:20am UTC](https://discuss.elastic.co/t/question-about-search-in-kibana/252929 "2020-10-22T05:20:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ThreatInter](https://avatars.discourse-cdn.com/v4/letter/t/49beb7/32.png) [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\
**Post date:** [October 22, 2020, 5:20am UTC](https://discuss.elastic.co/t/question-about-search-in-kibana/252929/1 "2020-10-22T05:20:47Z")

</div>

Hello everyone, I have something looking as a trouble in my Kibana, so I need to ask about searching in Kibana.  
I want to make search by ip in Kibana search string, I have "destination.ip" field in IP format and "destinationip" field in string format:

![изображение](https://us1.discourse-cdn.com/elastic/original/3X/0/b/0bdb4e1b5ab613425bd753f0b189838bcd55919f.png)

First field was added to index pattern that I uploaded to elastic by curl -X POST, and second appeared when I added data to elastic, but it hasn't field in index pattern  
If I try search ip in search string I recieve next null result:

 ![изображение](https://us1.discourse-cdn.com/elastic/original/3X/7/a/7abffdf6f442233d04b5c022f7d365464b7bb36f.png)

If I search as "destinationip:[IP]" I recieve this not null result:

 ![изображение](https://us1.discourse-cdn.com/elastic/original/3X/1/5/15b75de6cad24fa1b3a4f8260064a1c4eb61bc6b.png)

If I search as "destination.ip:[IP]" I recieve this not null result:

 ![изображение](https://us1.discourse-cdn.com/elastic/original/3X/8/7/873d5f16819fffa6b4b4d0cb3f8478f05765832d.png)

**So, my question is: Is it possible to make search typing ONLY ip addres in search string, without any keywords?** If yes, what I should do? If I add "destinationip" in index pattern and put it in to elastic by curl POST command I will be able to make search this way?  
For example it's works for event.type string field that added to index pattern :

 ![изображение](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e6e84bf03963c111e1abb5d50bd7620cc5c36771.png)

"destinationip" string field too, but this type of search doesn't work for it, maybe because it not added to index pattern

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [October 29, 2020, 7:05pm UTC](https://discuss.elastic.co/t/question-about-search-in-kibana/252929/2 "2020-10-29T19:05:13Z")

</div>

> [@ThreatInter](#):
>
> second appeared when I added data to elastic, but it hasn't field in index pattern

If the field doesn't exist in the index pattern even after clicking "Refresh" then the mapping of the field mapping does not enable the value to be searched.

Check the mapping of the field in Elasticsearch. See [enabled | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/enabled.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2020, 7:05pm UTC](https://discuss.elastic.co/t/question-about-search-in-kibana/252929/3 "2020-11-26T19:05:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.