# Weird issue with keyword field

**URL:** <https://discuss.elastic.co/t/weird-issue-with-keyword-field/225733>\
**Category:** Kibana\
**Created:** [March 30, 2020, 6:48pm UTC](https://discuss.elastic.co/t/weird-issue-with-keyword-field/225733 "2020-03-30T18:48:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tsgdphillips](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsgdphillips/32/65331_2.png) [@tsgdphillips](https://discuss.elastic.co/u/tsgdphillips)\
**Post date:** [March 30, 2020, 6:48pm UTC](https://discuss.elastic.co/t/weird-issue-with-keyword-field/225733/1 "2020-03-30T18:48:22Z")

</div>

I'm working on an issue with a client's kibana installation, where no results are returned for a specific keyword entry, but direct queries to elasticsearch _do_ return a result. There are three values in the field; the other two return just fine, just not this one...

ElasticSearch & Kibana version: 6.3.2

Any ideas?

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [March 31, 2020, 6:37pm UTC](https://discuss.elastic.co/t/weird-issue-with-keyword-field/225733/2 "2020-03-31T18:37:58Z")

</div>

Where in Kibana is this query being generated? What does the query look like? What does the index mapping look like? What does a sample document look like?

---

<div class="post-metadata">

**Author:** ![tsgdphillips](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsgdphillips/32/65331_2.png) [@tsgdphillips](https://discuss.elastic.co/u/tsgdphillips)\
**Post date:** [April 1, 2020, 12:37am UTC](https://discuss.elastic.co/t/weird-issue-with-keyword-field/225733/3 "2020-04-01T00:37:53Z")

</div>

Mapping for this field:

```auto
    "type" : {
        "type" : "keyword"
    },

```

The query that kibana generates when I add the filter in either the discover or visualize tabs (see note):

```auto
    {
      "query": {
        "match": {
          "type": {
            "query": "distributor-query-error",
            "type": "phrase"
          }
        }
      }
    }

```

_Note_: when testing this in postman, this above query yields this error regardless of the value for the type field, but changing "distributor-query-error" to another type does yield results in kibana:

```auto
    {
        "error": {
            "root_cause": [
                {
                    "type": "parsing_exception",
                    "reason": "[match] query does not support [type]",
                    "line": 6,
                    "col": 17
                }
            ],
            "type": "parsing_exception",
            "reason": "[match] query does not support [type]",
            "line": 6,
            "col": 17
        },
        "status": 400
    }

```

There are three possible values for this field:

- distributor-query
- search-summary
- distributor-query-error

Sample _found_ document (non-relevant fields stripped):

```auto
    {
      "_index": "part-search-2020.03",
      "_type": "_doc",
      "_id": "KroDM3EBoXAaVXXPmOSr",
      "_version": 1,
      "_score": null,
      "_routing": "75fa5b5d-dc89-4f8a-befc-09ff3382241d",
      "_source": {
        "type": "distributor-query",
      },
      "fields": {
        "@timestamp": [
          "2020-03-31T23:53:25.812Z"
        ],
        "submittedOn": [
          "2020-03-31T23:53:25.324Z"
        ]
      },
      "highlight": {
        "type": [
          "@kibana-highlighted-field@distributor-query@/kibana-highlighted-field@"
        ]
      },
      "sort": [
        1585698805324
      ]
    }

```

Sample _not found_ result:

```auto
    {
                "_index": "part-search-2020.03",
                "_type": "_doc",
                "_id": "PM6RLnEB3OX02Dcrv6TT",
                "_score": 9.735274,
                "_routing": "c2f0375e-5c95-437f-a0b2-7bad00e40454",
                "_source": {
                    "@timestamp": "2020-03-31T03:10:35.869Z",
                    "errorMessage": "Exception: API Search failed for Company ****. ---> System.AggregateException: One or more errors occurred. ---> System.Exception:****** Failied with status code 400: Invalid Request - Error(s) in Post Request field(s) - The Keywords field is required..\r\nValidation Errors:\r\n- Keywords: The Keywords field is required.\r\n at **************.ThrowApiError(String jsonContent) in (Remainder of error message)",
                    "source": "API",
                    "type": "distributor-query-error",
                    "@version": "1",
                    "distributor": "(snipped)",
                }
    },

```

Here is the search query that _does_ work in postman, as well as in the dev tools tab in kibana; putting the same query into either the discover or visualize tabs in kibana still fails to yield results:

```auto
    {
      "query": {
        "match": {
          "type": "distributor-query-error"
        }
      }
    }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2020, 12:43am UTC](https://discuss.elastic.co/t/weird-issue-with-keyword-field/225733/4 "2020-04-29T00:43:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.