# Unable to search on a specific field

**URL:** <https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114>\
**Category:** Elasticsearch\
**Created:** [July 24, 2019, 6:16pm UTC](https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114 "2019-07-24T18:16:56Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [July 24, 2019, 6:16pm UTC](https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114/1 "2019-07-24T18:16:56Z")

</div>

Hi,

I have 2 indexes created from 2 seperate templates. I am trying to unify some of the field names/schema.

I have 2 sets of data from 2 sources coming into logstash, I have used mutate and rename to change the name of a field from each source to the same name.

Data from both sources is just text and the templates have the types as text and keyword.

The data comes in, however I find that one of the data sources I can search on and filter on, the other brings up no data if i search or filter, even if in discover I click to filter on the field.

Any suggestions as to what could be happening?

Thanks  
Phil

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 24, 2019, 6:30pm UTC](https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114/2 "2019-07-24T18:30:33Z")

</div>

What is the mappings for these 2 indices? How do they compare for common fields?

---

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [July 24, 2019, 6:50pm UTC](https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114/3 "2019-07-24T18:50:15Z")

</div>

Hi,

Hopefully this is the correct info, both are the same:  
"mappings":{  
"doc":{  
"dynamic": false,  
"date\_detection": false,  
"properties":{  
"@timestamp":{  
"type":"date"

The field in question:  
"classification":{  
"type":"text",  
"fields":{  
"keyword":{  
"type":"keyword"  
}

Sorry what do you mean by compare for common fields?

Thanks  
Phil

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 24, 2019, 6:52pm UTC](https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114/4 "2019-07-24T18:52:41Z")

</div>

Can you get the mappings for each index and look at the mapping for fields that you renamed so they have the same name across both indices? I am looking for the mapping that is present, not the index template.

---

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [July 24, 2019, 7:47pm UTC](https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114/5 "2019-07-24T19:47:38Z")

</div>

Hi,

Ive just pulled the mapping for each index and the field is not mapped in the other index. I deleted all of the indexs for both after making the change to the template. Wonder what i missed.

Thanks  
Phil

---

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [July 24, 2019, 8:20pm UTC](https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114/6 "2019-07-24T20:20:44Z")

</div>

Thank you for your help, i retraced my steps and found the issue, a mistake i managed to replicate on both templates, resolved and deleted the indexs, pushed the data and its working as expected now.

Thanks for pointing me in the right direction.  
Phil

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2019, 8:20pm UTC](https://discuss.elastic.co/t/unable-to-search-on-a-specific-field/192114/7 "2019-08-21T20:20:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.