# Unable to Search Indexed Fields

**URL:** <https://discuss.elastic.co/t/unable-to-search-indexed-fields/50539>\
**Category:** Elasticsearch\
**Created:** [May 20, 2016, 8:07am UTC](https://discuss.elastic.co/t/unable-to-search-indexed-fields/50539 "2016-05-20T08:07:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_Tighe](https://avatars.discourse-cdn.com/v4/letter/j/8797f3/32.png) [@James\_Tighe](https://discuss.elastic.co/u/James_Tighe)\
**Post date:** [May 20, 2016, 8:07am UTC](https://discuss.elastic.co/t/unable-to-search-indexed-fields/50539/1 "2016-05-20T08:07:28Z")

</div>

Hi All,

I am relatively new to the Elastic Stack and am having good results so far. One thing I cannot get to work though is full text search on some of the fields.

I am using Filebeat to ship an unformatted log across to Logstash. Using GROK I am then adding fields based on patterns. These fields show fine in Kibana and I can visualise the data from them without issue.

The problem is that I cannot search these fields.

On of the fields is Priority and contains the value INF. If I try to search in the search bar using [Priority]:"INF" this returns no results. Even using lowercase returns nothing.

I can however search using

{"wildcard":{"Priority":"INF"}}

Is there something I have to set in the mapping to allow this field to be searched correctly?

My files are the type "log" and the index is showing the following mapping

> ```
> "properties": {
> "@timestamp": {
> "type": "date",
> "format": "strict_date_optional_time||epoch_millis"
> },
> "@version": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "ID": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "Message": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "Priority": {
> "type": "string",
> "index": "not_analyzed"
> },
> "Process": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "beat": {
> "properties": {
> "hostname": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "name": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> }
> }
> },
> "geoip": {
> "dynamic": "true",
> "properties": {
> "location": {
> "type": "geo_point"
> }
> }
> },
> "host": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "input_type": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "message": {
> "type": "string"
> },
> "offset": {
> "type": "long"
> },
> "source": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "tags": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "time": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> },
> "type": {
> "type": "string",
> "index": "not_analyzed",
> "ignore_above": 1024
> }
> }
> 
> ```

Is this to do with the index template being incorrect?

Any help would be appreciated.

Thanks

James

---

<div class="post-metadata">

**Author:** ![James\_Tighe](https://avatars.discourse-cdn.com/v4/letter/j/8797f3/32.png) [@James\_Tighe](https://discuss.elastic.co/u/James_Tighe)\
**Post date:** [May 23, 2016, 1:00pm UTC](https://discuss.elastic.co/t/unable-to-search-indexed-fields/50539/2 "2016-05-23T13:00:16Z")

</div>

I believe I located the problem to my own issue.

When I imported the Priority field from my data I had to perform a GSUB on the value as it had an extraneous square bracket. The GSUB replaced this with a space.

Therefore the filter failed as the field is not analysed so I had to search WITH the space in the string. If I do this it works and Kibana returns results.

Thanks

James

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:49pm UTC](https://discuss.elastic.co/t/unable-to-search-indexed-fields/50539/3 "2017-07-05T22:49:47Z")

</div>