# DSL Query to search in message field for some value and it must not contain something else
**URL:** https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450
**Category:** Elasticsearch
**Created:** [September 17, 2021, 6:53am UTC](https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450 "2021-09-17T06:53:41Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@mguttula](https://discuss.elastic.co/u/mguttula)
#### Post date: [September 17, 2021, 6:53am UTC](https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450/1 "2021-09-17T06:53:41Z")
Trying to come up with a query to search "message" field for something like "Hello" and also the field must not contain strings like "Test" "TestProcess". "UpdatingTestProcess"
Below are sample messages:
Message: Hello TestProcess is initiated.
Message: Hello SomeOtherProcess is initiated.
Message: UpdatingTestProcess is processing Hello data.
Message: SomeOtherProcess is processing Hello data.
Message: Hello TestUpdateProcess is successful in process Hello data.
Message: SomeOtherProcess is successful in process Hello data.
Message: Waiting for processes to complete their work.
**Hello** is there in all the above message except last messages and I am only interested in fetching message 2, 4 and 6 and ignore message 1, 3, and 5 which contain **"Test"** string. I also ignore last message as it doesn't contain "Hello" String
I tried below query but it didn't work and it is fetching message 1 through 6 and ignoring just 7th message.
```auto
{
"query": {
"bool": {
"must": [
{
"match": {
"message": {
"query": "Hello"
}
}
}
],
"must_not": [
{
"terms": {
"message": [
{
"query": "Test"
}
]
}
}
]
}
}
}
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [September 18, 2021, 7:35am UTC](https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450/2 "2021-09-18T07:35:25Z")
Welcome. It's because Test does not match TestProcess as they are not analyzed the same way.
You need to change the analyzer or use a this type: [Keyword type family | Elasticsearch Guide [7.14] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.14/keyword.html#wildcard-field-type) to run wildcard queries instead.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 16, 2021, 7:35am UTC](https://discuss.elastic.co/t/dsl-query-to-search-in-message-field-for-some-value-and-it-must-not-contain-something-else/284450/3 "2021-10-16T07:35:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.