# Search query problem
**URL:** https://discuss.elastic.co/t/search-query-problem/13491
**Category:** Elasticsearch
**Created:** [September 6, 2013, 1:00pm UTC](https://discuss.elastic.co/t/search-query-problem/13491 "2013-09-06T13:00:33Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Gabriele\_Angeli](https://discuss.elastic.co/u/Gabriele_Angeli)
#### Post date: [September 6, 2013, 1:00pm UTC](https://discuss.elastic.co/t/search-query-problem/13491/1 "2013-09-06T13:00:33Z")
After this search query _curl
localhost:9200/logstash-2013.09.06/\_search?pretty=true_ i have this
results:
"\_index" : "logstash-2013.09.06",
"\_type" : "domain\_alert",
"\_id" : "82-WdTekRUOMPCxYrr7Ceg",
"\_score" : 1.0, "\_source" : {"_@fields":{}_
,"@timestamp":"2013-09-06T10:43:35.335Z","_@message":""_
,"@type":"domain\_alert"}
}
The _@fields_ and _@message_ fields should be full of informations
because I'm be able to display the informations on Kibana dashboard.
Someone can help me?
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@javanna](https://discuss.elastic.co/u/javanna)
#### Post date: [September 6, 2013, 1:45pm UTC](https://discuss.elastic.co/t/search-query-problem/13491/2 "2013-09-06T13:45:10Z")
Hi Gabriele,
can you see some information on Kibana about the very same document/log (id
82-WdTekRUOMPCxYrr7Ceg)?
Are you missing that information under @fields and @message only for that
specific document when querying elasticsearch? Or for all documents?
Cheers
Luca
On Friday, September 6, 2013 3:00:33 PM UTC+2, Gabriele Angeli wrote:
> After this search query _curl
> localhost:9200/logstash-2013.09.06/\_search?pretty=true_ i have this
> results:
>
> "\_index" : "logstash-2013.09.06",
> "\_type" : "domain\_alert",
> "\_id" : "82-WdTekRUOMPCxYrr7Ceg",
> "\_score" : 1.0, "\_source" : {"_@fields":{}_
> ,"@timestamp":"2013-09-06T10:43:35.335Z","_@message":""_
> ,"@type":"domain\_alert"}
> }
>
> The _@fields_ and _@message_ fields should be full of informations
> because I'm be able to display the informations on Kibana dashboard.
> Someone can help me?
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@Gabriele\_Angeli](https://discuss.elastic.co/u/Gabriele_Angeli)
#### Post date: [September 6, 2013, 2:00pm UTC](https://discuss.elastic.co/t/search-query-problem/13491/3 "2013-09-06T14:00:27Z")
Hi Luca,
in Kibana everythings is fine. I see all fields for all documents.
In elasticsearch i don't see @fields and @message informations for all
documents.
Regards
Gabriele
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [September 6, 2013, 2:34pm UTC](https://discuss.elastic.co/t/search-query-problem/13491/4 "2013-09-06T14:34:50Z")
Hey Gabriele,
How did you configure logstash?
What does your logstash.conf file looks like?
--
David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com)
@dadoonet | @elasticsearchfr | @scrutmydocs
Le 6 sept. 2013 à 16:00, Gabriele Angeli [g.angeli8214@gmail.com](mailto:g.angeli8214@gmail.com) a écrit :
> Hi Luca,
> in Kibana everythings is fine. I see all fields for all documents.
>
> In elasticsearch i don't see @fields and @message informations for all documents.
>
> Regards
>
> Gabriele
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@Gabriele\_Angeli](https://discuss.elastic.co/u/Gabriele_Angeli)
#### Post date: [September 7, 2013, 9:52am UTC](https://discuss.elastic.co/t/search-query-problem/13491/5 "2013-09-07T09:52:16Z")
Hi David,
I post my configure file :
input {
file {
type =\> "data"
path =\> "/home/gabe/Deskop/data.log"
format =\> plain
start\_position =\> "beginning"
filter {
grok {
type =\> "data"
pattern =\>
"domain=%{GREEDYDATA:domain\_name},TLD=%{GREEDYDATA:tld},Registrant\_country=%{GREEDYDATA:Registrant\_country},create\_date=%{DATE:create\_date},update\_date=%{DATE:update\_date},expiration\_date=%{DATE:expiration\_date},owner=%{GREEDYDATA:owner},associated\_email=%{GREEDYDATA:associated\_email},desc=%{GREEDYDATA:desc},category=%{GREEDYDATA:category},severity=%{INT:severity},score\_level=%{INT:score\_level},source\_severity=%{INT:source\_severity},false\_positive=%{INT:false\_positive}"
} }
output {
elasticsearch {
type =\> "data"
index =\> "logstash-%{+YYYY.MM.dd}"
}
}
I want to repeat that in Kibana3 i'm be able to view every single fields
but not in elasticsearch
In elasticserach I do the following query
localhost:9200/"index"/\_search?pretty=true
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [September 7, 2013, 10:31am UTC](https://discuss.elastic.co/t/search-query-problem/13491/6 "2013-09-07T10:31:03Z")
Oh? Do you mean that curl commands does not work for you?
On almost every panel in Kibana, you have a small "eye" icon that helps to see the exact query Kibana does behind the scene.
I don't remember if the "spy" option exists on table panel. If it does, could you run the same query?
## HTH
David 😉
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs
Le 7 sept. 2013 à 11:52, Gabriele Angeli [g.angeli8214@gmail.com](mailto:g.angeli8214@gmail.com) a écrit :
> Hi David,
>
> I post my configure file :
>
> input {
> file {
> type =\> "data"
> path =\> "/home/gabe/Deskop/data.log"
> format =\> plain
> start\_position =\> "beginning"
>
> filter {
> grok {
> type =\> "data"
> pattern =\> "domain=%{GREEDYDATA:domain\_name},TLD=%{GREEDYDATA:tld},Registrant\_country=%{GREEDYDATA:Registrant\_country},create\_date=%{DATE:create\_date},update\_date=%{DATE:update\_date},expiration\_date=%{DATE:expiration\_date},owner=%{GREEDYDATA:owner},associated\_email=%{GREEDYDATA:associated\_email},desc=%{GREEDYDATA:desc},category=%{GREEDYDATA:category},severity=%{INT:severity},score\_level=%{INT:score\_level},source\_severity=%{INT:source\_severity},false\_positive=%{INT:false\_positive}"
> } }
>
> output {
> elasticsearch {
> type =\> "data"
> index =\> "logstash-%{+YYYY.MM.dd}"
> }
> }
>
> I want to repeat that in Kibana3 i'm be able to view every single fields but not in elasticsearch
> In elasticserach I do the following query localhost:9200/"index"/\_search?pretty=true
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [September 7, 2013, 10:54am UTC](https://discuss.elastic.co/t/search-query-problem/13491/7 "2013-09-07T10:54:13Z")
I think Kibana uses field option when querying.
--
David 😉
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs
Le 7 sept. 2013 à 12:31, David Pilato [david@pilato.fr](mailto:david@pilato.fr) a écrit :
> Oh? Do you mean that curl commands does not work for you?
>
> On almost every panel in Kibana, you have a small "eye" icon that helps to see the exact query Kibana does behind the scene.
> I don't remember if the "spy" option exists on table panel. If it does, could you run the same query?
>
> ## HTH
>
> David 😉
> Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs
>
> Le 7 sept. 2013 à 11:52, Gabriele Angeli [g.angeli8214@gmail.com](mailto:g.angeli8214@gmail.com) a écrit :
>
> > Hi David,
> >
> > I post my configure file :
> >
> > input {
> > file {
> > type =\> "data"
> > path =\> "/home/gabe/Deskop/data.log"
> > format =\> plain
> > start\_position =\> "beginning"
> >
> > filter {
> > grok {
> > type =\> "data"
> > pattern =\> "domain=%{GREEDYDATA:domain\_name},TLD=%{GREEDYDATA:tld},Registrant\_country=%{GREEDYDATA:Registrant\_country},create\_date=%{DATE:create\_date},update\_date=%{DATE:update\_date},expiration\_date=%{DATE:expiration\_date},owner=%{GREEDYDATA:owner},associated\_email=%{GREEDYDATA:associated\_email},desc=%{GREEDYDATA:desc},category=%{GREEDYDATA:category},severity=%{INT:severity},score\_level=%{INT:score\_level},source\_severity=%{INT:source\_severity},false\_positive=%{INT:false\_positive}"
> > } }
> >
> > output {
> > elasticsearch {
> > type =\> "data"
> > index =\> "logstash-%{+YYYY.MM.dd}"
> > }
> > }
> >
> > I want to repeat that in Kibana3 i'm be able to view every single fields but not in elasticsearch
> > In elasticserach I do the following query localhost:9200/"index"/\_search?pretty=true
> >
> > --
> > You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
> > --
> > You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@Gabriele\_Angeli](https://discuss.elastic.co/u/Gabriele_Angeli)
#### Post date: [September 7, 2013, 2:36pm UTC](https://discuss.elastic.co/t/search-query-problem/13491/8 "2013-09-07T14:36:24Z")
SOLVED!!!
Hi David, thanks for yours precious informations!!!
My original query was incomplete. The problem was that.
Regards
Gabriele
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@Gabriele\_Angeli](https://discuss.elastic.co/u/Gabriele_Angeli)
#### Post date: [September 8, 2013, 12:08pm UTC](https://discuss.elastic.co/t/search-query-problem/13491/9 "2013-09-08T12:08:02Z")
Hi David I saw kibana query, but i didn't understand which is the syntax to
extract @fields properties.
My question is: Is there a method to do this with a simple query? Because
kibana query is very complex.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [September 8, 2013, 3:42pm UTC](https://discuss.elastic.co/t/search-query-problem/13491/10 "2013-09-08T15:42:04Z")
Hey Gabriele,
Have a look at: [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/api/search/fields/)
It should help.
--
David 😉
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs
Le 8 sept. 2013 à 14:08, Gabriele Angeli [g.angeli8214@gmail.com](mailto:g.angeli8214@gmail.com) a écrit :
> Hi David I saw kibana query, but i didn't understand which is the syntax to extract @fields properties.
> My question is: Is there a method to do this with a simple query? Because kibana query is very complex.
>
> --
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@Gabriele\_Angeli](https://discuss.elastic.co/u/Gabriele_Angeli)
#### Post date: [September 9, 2013, 7:56am UTC](https://discuss.elastic.co/t/search-query-problem/13491/11 "2013-09-09T07:56:05Z")
Thank you David,
```
for the moment I resolved using the keyword "highlight".
```
Thank you very much for your time.
One of this day will add you on my twitter account.
Regards
Gabriele
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 2:17am UTC](https://discuss.elastic.co/t/search-query-problem/13491/12 "2017-07-06T02:17:34Z")