# How to DQL the nested field(group)?

**URL:** <https://forum.opensearch.org/t/how-to-dql-the-nested-field-group/16006>\
**Category:** OpenSearch\
**Created:** [September 22, 2023, 4:06am UTC](https://forum.opensearch.org/t/how-to-dql-the-nested-field-group/16006 "2023-09-22T04:06:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cucukaka](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@cucukaka](https://forum.opensearch.org/u/cucukaka)\
**Post date:** [September 22, 2023, 4:06am UTC](https://forum.opensearch.org/t/how-to-dql-the-nested-field-group/16006/1 "2023-09-22T04:06:01Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
opensearch 2.7.0

**Describe the issue** :  
mapping table

```auto
"url": {
      "type": "nested",
      "properties": {
        "ppp": {
          "type": "keyword"
        },
        "protocol": {
          "type": "keyword"
        },
        "fqdn": {
          "type": "keyword"
        },
        "port": {
          "type": "integer"
        },
        "urlid": {
          "type": "keyword"
        },
        "url": {
          "type": "keyword"
        }
      }
    }

```

and I put a document in the index

```auto
POST log-network-2023.09-000035/_doc
{
  "@timestamp": "2023-09-20T06:49:02Z",
  "uuid": "test",
    "url": [
    {
      "fqdn": "xxx",
      "method": "GET",
      "port": 443,
      "ppp": "xxx.json",
      "responsecode": 200,
      "url": "xxx",
      "urlid": "xxx"
    },
    {
      "fqdn": "xxx",
      "method": "GET",
      "port": 80,
      "ppp": "xxx",
      "responsecode": 200,
      "url": "xxx",
      "urlid": "xxx"
    }
  ]
}

```

in DQL  
**url: {port: 443}** → error  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/e/ed2558124d68081bd9723ec344b3e32764421123.png)  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/1/1cabff306685088c108e87c3a13c1e31400d28b3.png)

also **url.port: 443** not found result  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/2/2fd05567246e1d3992b6afea14f79943095624af.png)

so, how do DQL the nested group?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [October 6, 2023, 1:06am UTC](https://forum.opensearch.org/t/how-to-dql-the-nested-field-group/16006/2 "2023-10-06T01:06:55Z")

</div>

@cucukaka As per OpenSearch documentation, the correct DQL query for the nested field is:

```auto
url: {port: 443}

```

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/b/b1455a32d73ba7243df377ddad7f10b43f7480bc.png)

> **[Using Dashboards Query Language](https://opensearch.org/docs/2.9/dashboards/discover/dql/#querying-nested-fields)**
>
> Using Dashboards Query Language