# Searching custom fields does not work with Full Text query mode(?)

**URL:** <https://discuss.elastic.co/t/searching-custom-fields-does-not-work-with-full-text-query-mode/212683>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 20, 2019, 4:18pm UTC](https://discuss.elastic.co/t/searching-custom-fields-does-not-work-with-full-text-query-mode/212683 "2019-12-20T16:18:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![john\_eapen](https://avatars.discourse-cdn.com/v4/letter/j/b3f665/32.png) [@john\_eapen](https://discuss.elastic.co/u/john_eapen)\
**Post date:** [December 20, 2019, 4:18pm UTC](https://discuss.elastic.co/t/searching-custom-fields-does-not-work-with-full-text-query-mode/212683/1 "2019-12-20T16:18:50Z")

</div>

Hi

My log data contains several fields that Filebeat doesn’t know about in advance. ( eg: myapp.traceId, myapp.host.name etc. ). To avoid conflicts these are not directly root but under a root property "myapp".

Now, when I query explicitly as "myapp.traceId: abc123" , then this works BUT this does not work if  
I query simply as "abc123".

I am trying to play around with this setting "setup.template.append\_fields [experimental]"  
Or do I need to add these properties to fields.yml or something else to get them included into "default\_fields"

Appreciate the help  
Thx

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [December 20, 2019, 5:47pm UTC](https://discuss.elastic.co/t/searching-custom-fields-does-not-work-with-full-text-query-mode/212683/2 "2019-12-20T17:47:22Z")

</div>

Hi,

Yes, you should add these fields under `setup.template.append_fields` as shown in [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-template.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-template.html).

Once you've done that, you can verify that Filebeat will export these fields as part of the index template it will send to Elasticsearch by running `filebeat export template`. For the purposes of the "all fields" query effect that you're trying to achieve, verify that the fields are listed under the `settings.index.query.default_field` field in the exported template.

Shaunak

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2020, 5:47pm UTC](https://discuss.elastic.co/t/searching-custom-fields-does-not-work-with-full-text-query-mode/212683/3 "2020-01-17T17:47:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.