# Elasticsearch Query DSL Filter Including Middle Occurrences
**URL:** https://discuss.elastic.co/t/elasticsearch-query-dsl-filter-including-middle-occurrences/348143
**Category:** Elasticsearch
**Created:** [November 28, 2023, 12:58pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-filter-including-middle-occurrences/348143 "2023-11-28T12:58:49Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Dokh\_Ahmed](https://discuss.elastic.co/u/Dokh_Ahmed)
#### Post date: [November 28, 2023, 12:58pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-filter-including-middle-occurrences/348143/1 "2023-11-28T12:58:49Z")
Hello
I am facing an issue with Elastisearch Query DSL while using a prefix filter for the "log\_message" field.
The goal is to display logs where the "log\_message" field has a prefix of "Started". However, the filter is also including lines where "Started" appears in the middle of the message, not just at the beginning.
- Here's my query:
```auto
{
"prefix": {
"log_message": "started"
}
}
```
- Here's my log message:
2023-11-20 10:49:34.445 | INFO | [restartedMain] --- 14348 | o.a.c.impl.engine.AbstractCamelContext | | Started SEND\_AGENT\_REF\_TO\_S3\<2\> (direct://agentRefFromSiCas2-3)
PS: I have an espace between '| |' and 'Started'. ⬆
- Her's my logstash Pattern:
%{TIMESTAMP\_ISO8601:timestamp} |%{SPACE}_%{LOGLEVEL:log\_level}%{SPACE}_|%{SPACE}[%{DATA:thread}]%{SPACE}---%{SPACE}%{NUMBER:process\_id}%{SPACE}|%{SPACE}%{DATA:class}%{SPACE}| |%{SPACE}%{GREEDYDATA:log\_message}(\r|\n)?
---
### Author:  [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [December 9, 2023, 4:18pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-filter-including-middle-occurrences/348143/2 "2023-12-09T16:18:18Z")
Hi,
You can adjust your Logstash grok pattern to split the "log\_message" field into two separate fields: one for the "| |" part and one for the actual log message. Here's an example of how you can adjust your Logstash pattern:
```auto
%{TIMESTAMP_ISO8601:timestamp} \| %{LOGLEVEL:log_level} \| \[%{WORD:thread}] --- %{NUMBER:process_id} \| %{NOTSPACE:class} \| \| %{WORD:log_prefix} %{GREEDYDATA:log_message}
```
| 2023-11-20 10:49:34.445 | INFO | [restartedMain] --- 14348 | o.a.c.impl.engine.AbstractCamelContext | | Started SEND\_AGENT\_REF\_TO\_S3\<2\> (direct://agentRefFromSiCas2-3) |
| --- | --- | --- | --- | --- | --- |
| **MATCHED** | | | | | |
| timestamp | 2023-11-20·10:49:34.445 | | | | |
| log\_message | SEND\_AGENT\_REF\_TO\_S3\<2\>·(direct://agentRefFromSiCas2-3) | | | | |
| process\_id | 14348 | | | | |
| log\_level | INFO | | | | |
| thread | restartedMain | | | | |
| class | o.a.c.impl.engine.AbstractCamelContext | | | | |
| log\_prefix | Started | | | | |
This will return documents where the "log\_prefix" field starts with "Started"
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 6, 2024, 4:19pm UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-filter-including-middle-occurrences/348143/3 "2024-01-06T16:19:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.