# Searching Does not Return Results - Challenge **URL:** \ **Category:** Elasticsearch\ **Created:** [December 29, 2020, 10:02pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832 "2020-12-29T22:02:14Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [December 29, 2020, 10:02pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/1 "2020-12-29T22:02:14Z")
I have this log message in Elastic: ExtendedProperties [{"Name":"UserAgent","Value":"Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.13426; Pro)"} {"Name":"UserAuthenticationMethod","Value":"1"} {"Name":"RequestType","Value":"OAuth2:Token"} {"Name":"ResultStatusDetail","Value":"Success"} {"Name":"KeepMeSignedIn","Value":"false"}]. I have tried searching various ways for "OAuth2". Do you know how I can successfully search for it and get results? Thanks, Gary ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 29, 2020, 10:41pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/2 "2020-12-29T22:41:34Z")
> [@Gary\_Blackwell](#): > > I have tried searching various ways for "OAuth2". Can you share what you have tried? ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [December 30, 2020, 4:28pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/3 "2020-12-30T16:28:18Z")
'\*.keyword:(_OAuth2_)' OAuth2 "OAuth2" "OAuth2:Token" OAuth2:Token (_OAuth2:Token_) (_OAuth2_) text:(_OAuth2_) _OAuth2_ fuzzy:OAuth2 \*.keyword:(_OAuth2_) keyword:(_OAuth2_) text:OAuth2 ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 30, 2020, 4:57pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/4 "2020-12-30T16:57:01Z")
Is `ExtendedProperties` by any chance mapped as a nested field? ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [December 30, 2020, 6:40pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/5 "2020-12-30T18:40:34Z")
Do you know where the "path" comes from for a nested query or what query would I use to tell if there were nested fields? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 30, 2020, 7:54pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/6 "2020-12-30T19:54:41Z")
Check the `INDEXNAME/_mapping` endpoint. ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [December 30, 2020, 8:08pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/7 "2020-12-30T20:08:04Z")
Does this help? "ExtendedProperties" : { "properties" : { "\*" : { "type" : "object" } } There is a bunch of these. "ExtendedProperties" : { "type" : "keyword", "ignore\_above" : 1024 ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [January 5, 2021, 4:01pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/8 "2021-01-05T16:01:42Z")
Is there a way of knowing if it is a nested field or how to search and find this data? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 5, 2021, 7:15pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/9 "2021-01-05T19:15:18Z")
It'd be useful if you posted the entire thing please. Please format your code/logs/config using the `` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂 ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [January 6, 2021, 8:37pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/10 "2021-01-06T20:37:46Z")
The post is limited to 13000 characters. The output is over 58000. I am not finding a way to attach it as a text file. Do you have any suggestions? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 6, 2021, 8:41pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/11 "2021-01-06T20:41:16Z")
Use gist/pastebin/etc. ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [January 6, 2021, 8:55pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/12 "2021-01-06T20:55:57Z")
> **[Index - Pastebin.com](https://pastebin.com/gWKrXPiV)** > > Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time. ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [January 13, 2021, 4:37pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/13 "2021-01-13T16:37:50Z")
Were you able to review the index? What started this query is that there is a detection rule that looks at OAuth2; however, I am not able to confirm that it is working. The paste bin post will be deleted in 4 hours, but I can repost it if necessary. ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [January 18, 2021, 7:24pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/14 "2021-01-18T19:24:10Z")
Any movement on this request? Thanks ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [January 27, 2021, 2:15pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/15 "2021-01-27T14:15:33Z")
Keeping this alive. Thanks ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [February 12, 2021, 7:42pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/16 "2021-02-12T19:42:51Z")
Any word on being able to complete the search? ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [February 22, 2021, 3:34pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/17 "2021-02-22T15:34:14Z")
Keep alive ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [March 1, 2021, 3:43pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/18 "2021-03-01T15:43:08Z")
Keep alive ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 1, 2021, 10:19pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/19 "2021-03-01T22:19:07Z")
If you don't get an answer, my recommendation would be to provide a full recreation script as described in [About the Elasticsearch category](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will help to better understand what you are doing. Please, try to keep the example as simple as possible. A full reproduction script is something anyone can copy and paste in Kibana dev console, click on the run button to reproduce your use case. It will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer. ---
**Author:** ![Gary\_Blackwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_blackwell/32/62181_2.png) [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Post date:** [March 2, 2021, 4:21pm UTC](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832/20 "2021-03-02T16:21:36Z")
I'm using Kibana. I can browse in the logs and find {"Name":"RequestType","Value":"OAuth2:Token"} in the log message. I haven't found a way to search for log messages that contain "OAuth2". Does that help? [Next page](https://discuss.elastic.co/t/searching-does-not-return-results-challenge/259832.md?page=2)