# DSL Query for text in quotes **URL:** \ **Category:** Elasticsearch\ **Created:** [April 23, 2020, 11:16pm UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556 "2020-04-23T23:16:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![VSP](https://avatars.discourse-cdn.com/v4/letter/v/e495f1/32.png) [@VSP](https://discuss.elastic.co/u/VSP)\ **Post date:** [April 23, 2020, 11:16pm UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556/1 "2020-04-23T23:16:02Z")
Hello, I have a sample message as below in log with several other messages too: {"kind":"user\_test","sts":"2020-04-23 10:26:29","uc":,"rc":"ok","errc":0} I am trying to write a query to find all the messages with a combination of "kind":"user\_test" and "rc":"ok" and "errc":0 I tried using multi\_match and match phrase, however its ignoring the and condition and just selecting all the messages with any of the above keywords. Can someone help if you have a similar DSL query that you used anywhere please ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [April 23, 2020, 11:55pm UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556/2 "2020-04-23T23:55:04Z")
Hello @VSP I think the query syntax you're proposing better matches the [Query String query API](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html). ```auto GET /_search { "query": { "query_string" : { "query" : "kind:user_test AND rc:ok AND errc:0", "default_field" : "content" } } } ``` Boolean operators must be UPPERCASE. ---
**Author:** ![VSP](https://avatars.discourse-cdn.com/v4/letter/v/e495f1/32.png) [@VSP](https://discuss.elastic.co/u/VSP)\ **Post date:** [April 24, 2020, 12:24am UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556/3 "2020-04-24T00:24:58Z")
Hello, That dint work, probably because of the way the messages are in the log with quotes. Below is the full message i see in the log: {"kind":"user\_test","sts":"2020-04-23 10:26:29","uc":,"rc":"ok","errc":0} How do i ensure that the full text including the quotes is being compared? "kind":"user\_test" ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [April 24, 2020, 12:41am UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556/4 "2020-04-24T00:41:27Z")
Hello @VSP Sorry, my bad. I misunderstood the problem. You have a some text such as `{"kind":"user_test","sts":"2020-04-23 10:26:29","uc":,"rc":"ok","errc":0}` in a text field in a document in Elasticsearch. If the text is contained in a `text` field named `message`, you can search with: ```auto GET your_index_name/_search { "query": { "query_string": { "query": "\"\"kind\":\"user_test\"\" AND \"\"rc\":\"ok\"\" AND \"\"errc\":0\"", "default_field": "message" } } } ``` ---
**Author:** ![VSP](https://avatars.discourse-cdn.com/v4/letter/v/e495f1/32.png) [@VSP](https://discuss.elastic.co/u/VSP)\ **Post date:** [April 24, 2020, 12:51am UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556/5 "2020-04-24T00:51:46Z")
Hello Luca, Thanks for your response. While the query did work this time, the problem is that it separated the text ("kind":"user\_test" ) as separate words and any hits on either KIND or USER\_TEST in the entire log was selected. Ideally it should have been just those messages with the combination of full text : ["kind":"user\_test"] along with the ["rc":"ok"] and ["errc":0] ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [April 25, 2020, 5:53pm UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556/6 "2020-04-25T17:53:32Z")
When you index some text, it gets analyzed by Elasticsearch. Using the default analyzer: ```auto POST _analyze { "text": ["{\"kind\":\"user_test\",\"sts\":\"2020-04-23 10:26:29\",\"uc\":,\"rc\":\"ok\",\"errc\":0}"] } ``` Internally Elasticsearch will generate the tokens: ```auto { "tokens" : [ { "token" : "kind", "start_offset" : 2, "end_offset" : 6, "type" : "", "position" : 0 }, { "token" : "user_test", "start_offset" : 9, "end_offset" : 18, "type" : "", "position" : 1 }, { "token" : "sts", "start_offset" : 21, "end_offset" : 24, "type" : "", "position" : 2 }, { "token" : "2020", "start_offset" : 27, "end_offset" : 31, "type" : "", "position" : 3 }, { "token" : "04", "start_offset" : 32, "end_offset" : 34, "type" : "", "position" : 4 }, { "token" : "23", "start_offset" : 35, "end_offset" : 37, "type" : "", "position" : 5 }, { "token" : "10", "start_offset" : 38, "end_offset" : 40, "type" : "", "position" : 6 }, { "token" : "26", "start_offset" : 41, "end_offset" : 43, "type" : "", "position" : 7 }, { "token" : "29", "start_offset" : 44, "end_offset" : 46, "type" : "", "position" : 8 }, { "token" : "uc", "start_offset" : 49, "end_offset" : 51, "type" : "", "position" : 9 }, { "token" : "rc", "start_offset" : 55, "end_offset" : 57, "type" : "", "position" : 10 }, { "token" : "ok", "start_offset" : 60, "end_offset" : 62, "type" : "", "position" : 11 }, { "token" : "errc", "start_offset" : 65, "end_offset" : 69, "type" : "", "position" : 12 }, { "token" : "0", "start_offset" : 71, "end_offset" : 72, "type" : "", "position" : 13 } ] } ``` Another search query might be quite equivalent: ```auto GET crazytest/_search { "query": { "query_string": { "query": "kind AND user_test AND rc AND ok AND errc AND 0", "default_field": "message" } } } ``` If you really want to search for specific strings within the text, you should change the analyzer (but it will require reindexing) or try to query on the keyword field (if you have the same data but in a `keyword` field), but it will be an heavy query as you will need to rely on leading wildcards or a regular expression. Ref: - [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html) - [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 23, 2020, 5:53pm UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556/7 "2020-05-23T17:53:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.