# Returning proper information?

**URL:** <https://discuss.elastic.co/t/returning-proper-information/121903>\
**Category:** Kibana\
**Created:** [February 28, 2018, 5:00pm UTC](https://discuss.elastic.co/t/returning-proper-information/121903 "2018-02-28T17:00:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmgarcia](https://avatars.discourse-cdn.com/v4/letter/j/e56c9b/32.png) [@jmgarcia](https://discuss.elastic.co/u/jmgarcia)\
**Post date:** [February 28, 2018, 5:00pm UTC](https://discuss.elastic.co/t/returning-proper-information/121903/1 "2018-02-28T17:00:06Z")

</div>

I have been tasked with a huge project and I am clueless. Pretty much I need to take lines of a file and use them to search Kibana. I have found the dev console, which is great, but I seem to not be getting the results I need... IF there is a hit from the query, say "test1 OR test2", I need the output to give me the src\_ip, dest\_ip, application along with some other information. I also need to somehow download this in readable forms.

Here is an example of my code that I am using to "search":

> ```
> GET /_search
> {
> "query": {
> "query_string" : {
> "fields" : ["src_ip","dst_ip","Application"],
> "query" : "devicename: (test1 OR test2) AND policy_id: 15561"
> }
> }
> }
> 
> ```

This is the output of what I am getting:

> ```
> {
> "took": 163,
> "timed_out": false,
> "_shards": {
> "total": 1791,
> "successful": 1791,
> "failed": 0
> },
> "hits": {
> "total": 0,
> "max_score": null,
> "hits": []
> }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [March 1, 2018, 7:12pm UTC](https://discuss.elastic.co/t/returning-proper-information/121903/2 "2018-03-01T19:12:50Z")

</div>

Can you share what your data looks like? It's useful to know how you're index data into Elasticsearch to help figure out how to find the information you're trying to get.

---

<div class="post-metadata">

**Author:** ![jmgarcia](https://avatars.discourse-cdn.com/v4/letter/j/e56c9b/32.png) [@jmgarcia](https://discuss.elastic.co/u/jmgarcia)\
**Post date:** [March 1, 2018, 7:45pm UTC](https://discuss.elastic.co/t/returning-proper-information/121903/3 "2018-03-01T19:45:47Z")

</div>

To be honest, I am not sure sure how to respond to your question, I will share whatever I can with you though. Could you provide an example maybe?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2018, 7:46pm UTC](https://discuss.elastic.co/t/returning-proper-information/121903/4 "2018-03-29T19:46:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.