# Elasticsearch query to capture '#' character

**URL:** <https://discuss.elastic.co/t/elasticsearch-query-to-capture-character/305906>\
**Category:** Kibana\
**Created:** [May 30, 2022, 8:02am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-capture-character/305906 "2022-05-30T08:02:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![andresf](https://avatars.discourse-cdn.com/v4/letter/a/22d042/32.png) [@andresf](https://discuss.elastic.co/u/andresf)\
**Post date:** [May 30, 2022, 8:02am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-capture-character/305906/1 "2022-05-30T08:02:51Z")

</div>

Hi,

I want to create alert based on Elasticsearch query result and we have log message that contain "Error #-" from specific hostname.

```auto
{
  "query": {
    "bool": {
      "must": [
        { "match": {"message": "Error #-"}},
        { "match": {"agent.hostname":"hostname"}}
      ]
    }
  }
}

```

Using that query, I couldn't capture those specific log message, instead it capture all message that contain "Error".

How can I capture message that contain "Error #-" only?

Thank you.  
Andre

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [June 1, 2022, 11:58am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-capture-character/305906/2 "2022-06-01T11:58:44Z")

</div>

Hi,

That is because "match" query is a [Full text query](https://www.elastic.co/guide/en/elasticsearch/reference/current/full-text-queries.html). Both document fields and query sentences are analyzed to tokens. Maybe the analyzer ignored "#-" and not indexed it as a token.

For exact partial match search, use wildcard queries for wildcard fields or use match phrase query with ngram analyzer. [This post](https://discuss.elastic.co/t/ngram-vs-wildcard-using-ngrams-instead-of-wildcards/260809) is related.

If "Error #-" is a prefix, use keyword mapping and [prefix query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-prefix-query.html) is another option.

If performance is acceptable, use [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html) with your own script to parse the `message` field is also another option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2022, 11:59am UTC](https://discuss.elastic.co/t/elasticsearch-query-to-capture-character/305906/3 "2022-06-29T11:59:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.