# Term join not yielding results when using Keyword field as left source

**URL:** https://discuss.elastic.co/t/term-join-not-yielding-results-when-using-keyword-field-as-left-source/229080
**Category:** Kibana
**Tags:** maps
**Created:** [April 21, 2020, 3:18pm UTC](https://discuss.elastic.co/t/term-join-not-yielding-results-when-using-keyword-field-as-left-source/229080 "2020-04-21T15:18:26Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Bustencio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bustencio/32/67857_2.png) [@Bustencio](https://discuss.elastic.co/u/Bustencio)
#### Post date: [April 21, 2020, 3:18pm UTC](https://discuss.elastic.co/t/term-join-not-yielding-results-when-using-keyword-field-as-left-source/229080/1 "2020-04-21T15:18:26Z")

</div>

Hi,

I'm trying to join 2 indexes through term join in Elastic Maps but I'm having trouble retrieving results when I use a "fieldName.keyword" field as the left source of the join, meanwhile I'm not having any trouble retrieving the expected results when assigning the .keyword field value to a scripted field and using that as the left source.

When inspecting the query I can see that the response from the server is the same for both requests.

Included are screenshots from the responses (using both fields as sources) and the scripted field definition so you can see that both fields should have the same information.

- Term join using original field (fieldName.keyword):

 ![Captura de pantalla 2020-04-21 a las 17.08.54](https://us1.discourse-cdn.com/elastic/original/3X/7/1/71d61613ba98c26563708a46a349363dba00830b.png)  
 ![Captura de pantalla 2020-04-22 a las 1.19.15](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e2d76811d72b3868e450197206612e4f020db309.jpeg)

- Term join using scripted field:

 ![Captura de pantalla 2020-04-21 a las 17.08.20](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a148076d629c6d3a96cdefe281548e1bb55c183.png)  
 ![Captura de pantalla 2020-04-21 a las 17.10.26](https://us1.discourse-cdn.com/elastic/original/3X/5/0/5023c0ac464ded9eba1ecf25c039b2fc0c5da4bf.jpeg)

- Scripted field definition:

 ![Captura de pantalla 2020-04-21 a las 17.12.36](https://us1.discourse-cdn.com/elastic/original/3X/c/f/cf6edf9491582393405195b3b8f443185821e031.png)

I can provide any additional information needed.

Thank you, cheers.

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [April 21, 2020, 9:14pm UTC](https://discuss.elastic.co/t/term-join-not-yielding-results-when-using-keyword-field-as-left-source/229080/2 "2020-04-21T21:14:57Z")

</div>

It looks like the screen shot for `host.keyword` response is actually showing the response for scripted field `hostname`. You can tell by looking at the request description. The left source always says `copt-fast-aldi*:hostname`. I would expect one to include the text `copt-fast-aldi*:host.keyword`.

Could you re-post the response for `host.keyword`?

Thanks

---

<div class="post-metadata">

### Author: ![Bustencio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bustencio/32/67857_2.png) [@Bustencio](https://discuss.elastic.co/u/Bustencio)
#### Post date: [April 21, 2020, 11:24pm UTC](https://discuss.elastic.co/t/term-join-not-yielding-results-when-using-keyword-field-as-left-source/229080/3 "2020-04-21T23:24:16Z")

</div>

My bad, I uploaded the wrong screenshot. Edited the original post to show the right one, sorry!

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [April 22, 2020, 12:22am UTC](https://discuss.elastic.co/t/term-join-not-yielding-results-when-using-keyword-field-as-left-source/229080/4 "2020-04-22T00:22:52Z")

</div>

What does the left source look like? Is the left source returning results in both cases. If using a time filter, could you use an absolute time to ensure both cases are comparing the same things?

---

<div class="post-metadata">

### Author: ![Bustencio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bustencio/32/67857_2.png) [@Bustencio](https://discuss.elastic.co/u/Bustencio)
#### Post date: [April 22, 2020, 8:22am UTC](https://discuss.elastic.co/t/term-join-not-yielding-results-when-using-keyword-field-as-left-source/229080/5 "2020-04-22T08:22:47Z")

</div>

The left source is a network host identifier, in our mapping we have both text field and keyword. I applied an absolute time filter (April 15th 12am - April 22nd 12am) but the output is the same.

This is what the left source looks like under the discover tab with the same filters applied:

 ![Captura de pantalla 2020-04-22 a las 9.50.08](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea408a984c12eeae6e424bdb88a55f2638faf1c1.png)

This is the mapping:

 ![Captura de pantalla 2020-04-22 a las 9.34.37](https://us1.discourse-cdn.com/elastic/original/3X/1/8/187753d3a2dfd3e972875a5d0a4c770b5f458d17.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 20, 2020, 8:22am UTC](https://discuss.elastic.co/t/term-join-not-yielding-results-when-using-keyword-field-as-left-source/229080/6 "2020-05-20T08:22:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.