# Raw field in top N query not working **URL:** \ **Category:** Elasticsearch\ **Created:** [August 1, 2014, 10:26pm UTC](https://discuss.elastic.co/t/raw-field-in-top-n-query-not-working/19040 "2014-08-01T22:26:51Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Eitan\_Vesely](https://avatars.discourse-cdn.com/v4/letter/e/82dd89/32.png) [@Eitan\_Vesely](https://discuss.elastic.co/u/Eitan_Vesely)\ **Post date:** [August 1, 2014, 10:26pm UTC](https://discuss.elastic.co/t/raw-field-in-top-n-query-not-working/19040/1 "2014-08-01T22:26:51Z")
Hi all, i have a field named "msg" in my index that holds an error message string. when trying to count the top N errors i set the field to msg.raw yet i still see that the terms are all the words comprising the strings rather than the whole string as i would expect. (i did not set this field to be "not\_analyzed and if i understand correctly logstash does that and puts it under the "raw" tag...) this is my input, configuration and output [image: image] [https://cloud.githubusercontent.com/assets/8070047/3785753/b6d09b46-19c9-11e4-8eba-5036e867b265.png](https://cloud.githubusercontent.com/assets/8070047/3785753/b6d09b46-19c9-11e4-8eba-5036e867b265.png) [image: image] [https://cloud.githubusercontent.com/assets/8070047/3785744/7b0566f0-19c9-11e4-9227-01efff20a812.png](https://cloud.githubusercontent.com/assets/8070047/3785744/7b0566f0-19c9-11e4-9227-01efff20a812.png) [image: image] [https://cloud.githubusercontent.com/assets/8070047/3785736/62d79f1c-19c9-11e4-93cf-f5dd89ffc8e7.png](https://cloud.githubusercontent.com/assets/8070047/3785736/62d79f1c-19c9-11e4-93cf-f5dd89ffc8e7.png) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/b7d9b1bd-7cbc-4fc9-820c-a88eb6c56078%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/b7d9b1bd-7cbc-4fc9-820c-a88eb6c56078%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Eitan\_Vesely](https://avatars.discourse-cdn.com/v4/letter/e/82dd89/32.png) [@Eitan\_Vesely](https://discuss.elastic.co/u/Eitan_Vesely)\ **Post date:** [August 2, 2014, 11:54am UTC](https://discuss.elastic.co/t/raw-field-in-top-n-query-not-working/19040/2 "2014-08-02T11:54:54Z")
Anyone? please? On Saturday, August 2, 2014 1:26:51 AM UTC+3, Eitan Vesely wrote: > Hi all, > > i have a field named "msg" in my index that holds an error message string. > when trying to count the top N errors i set the field to msg.raw yet i > still see that the terms are all the words comprising the strings rather > than the whole string as i would expect. > (i did not set this field to be "not\_analyzed and if i understand > correctly logstash does that and puts it under the "raw" tag...) > this is my input, configuration and output > [image: image] > [https://cloud.githubusercontent.com/assets/8070047/3785753/b6d09b46-19c9-11e4-8eba-5036e867b265.png](https://cloud.githubusercontent.com/assets/8070047/3785753/b6d09b46-19c9-11e4-8eba-5036e867b265.png) > > [image: image] > [https://cloud.githubusercontent.com/assets/8070047/3785744/7b0566f0-19c9-11e4-9227-01efff20a812.png](https://cloud.githubusercontent.com/assets/8070047/3785744/7b0566f0-19c9-11e4-9227-01efff20a812.png) > > [image: image] > [https://cloud.githubusercontent.com/assets/8070047/3785736/62d79f1c-19c9-11e4-93cf-f5dd89ffc8e7.png](https://cloud.githubusercontent.com/assets/8070047/3785736/62d79f1c-19c9-11e4-93cf-f5dd89ffc8e7.png) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9c869767-8119-45b0-a3b8-58f5389c01a7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9c869767-8119-45b0-a3b8-58f5389c01a7%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:11am UTC](https://discuss.elastic.co/t/raw-field-in-top-n-query-not-working/19040/3 "2017-07-06T01:11:27Z")
Closed on July 6, 2017, 1:11am UTC