# Exact match in the filter query

**URL:** <https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321>\
**Category:** Elasticsearch\
**Created:** [September 20, 2019, 12:21am UTC](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321 "2019-09-20T00:21:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JohnM](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johnm/32/49468_2.png) [@JohnM](https://discuss.elastic.co/u/JohnM)\
**Post date:** [September 20, 2019, 12:21am UTC](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321/1 "2019-09-20T00:21:16Z")

</div>

Hi friends,

I am making my python script to query es to search Linux syslog.

the script sends the following query.

```
{'query': {'bool': {'filter': [{'query_string': {'query': 'oom-killer AND exim'}}, {'range': {'@timestamp': {'time_zone': '+10:00', 'lte': 'now/d', 'gte': 'now-2d/d'}}}, {'term': {'host': '172.17.47.16'}}]}}, 'size': 500, 'sort': [{'@timestamp': {'order': 'asc'}}, {'@timestamp': {'order': 'asc'}}]}

```

and I get the following 2 results.

2019-09-19 07:43:58.997: 172.17.47.16: \<22\>Sep 19 07:43:57 relay1 exim[15865]: 2019-09-19 07:43:57 [15865] H=(WIN-PIBB3MI829B) [119.111.123.123]:56428 I=[119.111.123.123]:25 incomplete transaction (connection lost) from \< **killer** @com.au\>

2019-09-19 09:41:55.642: 172.17.47.16: \<22\>Sep 19 09:41:54 relay1 exim[24071]: 2019-09-19 09:41:54 [24071] 1iAja6-0006GF-Ir \<= nagios@overthewire.com.au [H=gen-111.111.111.someting.net](http://H=gen-111.111.111.someting.net) ([monitor.something.com](http://monitor.something.com)) [119.111.123.123]:60354 I=[172.17.47.16]:25 P=esmtps X=TLS1.2:ECDHE\_RSA\_AES\_256\_GCM\_SHA384:256 CV=no S=1333 M8S=0 [id=E1iAjZw-000AVV-Mf@monitor.something.com](mailto:id=E1iAjZw-000AVV-Mf@monitor.something.com) T="[RECOVERY] **Killer** Check on admin2.bne.overthewire.net.au is OK!" from [nagios@something.com](mailto:nagios@something.com) for [team@monitor.something.com](mailto:team@monitor.something.com)

I was expecting exact match of search word " **oom-killer** AND exim" in syslog message but results don't have word oom-killer but **Killer** and **killer**.  
If I used term instead of query\_string it would be exact match but you can't use AND, OR in term.

How can you make exact match query with AND/OR statement?

Thanks for your help in advance.  
ES7

---

<div class="post-metadata">

**Author:** ![abdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdon/32/9195_2.png) [@abdon](https://discuss.elastic.co/u/abdon)\
**Post date:** [September 20, 2019, 10:03am UTC](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321/2 "2019-09-20T10:03:13Z")

</div>

You can surround your search terms by quotes. So, search for:

```auto
"oom-killer" AND "exim"

```

---

<div class="post-metadata">

**Author:** ![JohnM](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johnm/32/49468_2.png) [@JohnM](https://discuss.elastic.co/u/JohnM)\
**Post date:** [September 26, 2019, 8:29am UTC](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321/3 "2019-09-26T08:29:05Z")

</div>

Thanks abdon,  
Yeah, now I can get expected results with "".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2019, 8:29am UTC](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321/4 "2019-10-24T08:29:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.