# Search queries showing wrong results

**URL:** <https://discuss.elastic.co/t/search-queries-showing-wrong-results/145082>\
**Category:** Kibana\
**Created:** [August 20, 2018, 4:44am UTC](https://discuss.elastic.co/t/search-queries-showing-wrong-results/145082 "2018-08-20T04:44:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [August 20, 2018, 4:44am UTC](https://discuss.elastic.co/t/search-queries-showing-wrong-results/145082/1 "2018-08-20T04:44:09Z")

</div>

I saw in documentation that its better to have less indexes and created only 1 index for all my different types of JSON.

I have a `fields.log_type` which shows different types of services that generate the logs. When I make a query the said field exists in all logs and one more field `responseCode` exists in only 1 service log. So when I query I am getting wrong results kindly suggest.

`fields.log_type: tomcat and responseCode: 200`

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [August 20, 2018, 7:08pm UTC](https://discuss.elastic.co/t/search-queries-showing-wrong-results/145082/2 "2018-08-20T19:08:22Z")

</div>

Can you provide the mapping for the index? Specifically, for `fields` and `responseCode`.

What does your query HTTP request look like? Can you try your query in Kibana `Dev Tools` -\> `Console` and paste the query here?

Why is the query not working? Is it returning an error? If not, what results is the query returning and why are they not what you expected?

---

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [August 21, 2018, 4:10am UTC](https://discuss.elastic.co/t/search-queries-showing-wrong-results/145082/3 "2018-08-21T04:10:33Z")

</div>

No sure what you need about the fields. These are the fields that are generated by filebeat and logstash respectively.

The query is returning incorrect set of records its not a rest query its the SQL type query in kibana using which we search for records or filter records.

My query looks like 🙂

> ```
> GET /_search
> {
> "from": 0,
> "query": {
> "bool": {
> "must": [
> {
> "match": {
> "logLevel.keyword": {
> "query": "ERROR",
> "operator": "OR",
> "prefix_length": 0,
> "max_expansions": 50,
> "fuzzy_transpositions": true,
> "lenient": false,
> "zero_terms_query": "NONE",
> "auto_generate_synonyms_phrase_query": true,
> "boost": 1
> }
> }
> }
> ],
> "adjust_pure_negative": true,
> "boost": 1
> }
> }
> }
> 
> ```

In kibana the query is working fine but in my JAVA code something is missing due to which I get response as 0 from `response.getHits().getTotalHits()`

---

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [August 29, 2018, 8:26am UTC](https://discuss.elastic.co/t/search-queries-showing-wrong-results/145082/4 "2018-08-29T08:26:20Z")

</div>

The below DSL works just fine but my java code, the `RestHighLevelClient` is not returning me anyting I have totally exhausted all my resources :

```
GET /_search
{
  "from": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "logLevel.keyword": {
              "query": "ERROR",
              "operator": "OR",
              "prefix_length": 0,
              "max_expansions": 50,
              "fuzzy_transpositions": true,
              "lenient": false,
              "zero_terms_query": "NONE",
              "auto_generate_synonyms_phrase_query": true,
              "boost": 1
            }
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  }
}

```

`response.getHits().getTotalHits()` is returning 0 and I am expecting 1. Please help.

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [August 29, 2018, 2:11pm UTC](https://discuss.elastic.co/t/search-queries-showing-wrong-results/145082/5 "2018-08-29T14:11:44Z")

</div>

> its not a rest query its the SQL type query in kibana

All queries to elasticsearch are REST - they are transported over HTTP and use the verbs `GET`, `POST`, `PUT`, and `DELETE`. The Java client uses the exact same mechanism, it just provides a nice API around the underlying HTTP requests and responses.

Log the query request generated by the Java client, in either elasticsearch or via the Java client. Then compare how the `_search` request is different between the working version and the Java generated version.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2018, 2:11pm UTC](https://discuss.elastic.co/t/search-queries-showing-wrong-results/145082/6 "2018-09-26T14:11:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.