# Does case matter in timelion queries (which use "and" or "or")

**URL:** <https://discuss.elastic.co/t/does-case-matter-in-timelion-queries-which-use-and-or-or/199542>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [September 15, 2019, 4:21pm UTC](https://discuss.elastic.co/t/does-case-matter-in-timelion-queries-which-use-and-or-or/199542 "2019-09-15T16:21:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bf31415](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@bf31415](https://discuss.elastic.co/u/bf31415)\
**Post date:** [September 15, 2019, 4:21pm UTC](https://discuss.elastic.co/t/does-case-matter-in-timelion-queries-which-use-and-or-or/199542/1 "2019-09-15T16:21:34Z")

</div>

I'm trying to build a query for ssh traffic-- for my field names, if the ipProtocol is 6 (tcp) and srcPort is 22 or dstPort is 22, then this is a match.

In timelion I've created the following two queries:

.es(index=sessions2\*, q="ipProtocol:6 and (dstPort:22 or srcPort:22)", timefield=lastPacket,metric=count).color(red).label("ssh-lower-case"),

.es(index=sessions2\*, q="ipProtocol:6 AND (dstPort:22 OR srcPort:22)", timefield=lastPacket,metric=count).color(blue).label("ssh-upper-case").points(show=true).lines(show=true)

and the lines shown are different. Apparently the above two queries yield different results.

So two questions.

1. Is the above logic correct if I want "ipProtocol:6 and (srcPort:22 or dstPort:22)"?

2. Does case matter and if so should it be upper or lower?

THanks

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [September 16, 2019, 2:35pm UTC](https://discuss.elastic.co/t/does-case-matter-in-timelion-queries-which-use-and-or-or/199542/2 "2019-09-16T14:35:05Z")

</div>

Hey @bf31415, when using the `q=` parameter for Timelion, that is the equivalent of the `q` parameter for the [Elasticsearch URI Search](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-uri-request.html), which uses the [Lucene Query Syntax](https://www.elastic.co/guide/en/kibana/current/lucene-query.html). You'll want to use the capitalized versions of `AND` and `OR`, or else the search will just be a "free text search".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2019, 2:35pm UTC](https://discuss.elastic.co/t/does-case-matter-in-timelion-queries-which-use-and-or-or/199542/3 "2019-10-14T14:35:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.