# Filter field
**URL:** https://discuss.elastic.co/t/filter-field/103872
**Category:** Kibana
**Created:** [October 13, 2017, 10:21am UTC](https://discuss.elastic.co/t/filter-field/103872 "2017-10-13T10:21:31Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Akaren](https://discuss.elastic.co/u/Akaren)
#### Post date: [October 13, 2017, 10:21am UTC](https://discuss.elastic.co/t/filter-field/103872/1 "2017-10-13T10:21:31Z")
Hi, I am having Kibana 5.4.0. I am filtering in top bar:
a) attrs.from:iptel.org -\> this works, returns attrs.from where substring is "[iptel.org](http://iptel.org)"
b) [iptel.org](http://iptel.org) -\> works, return any field that contains substring "[iptel.org](http://iptel.org)"
c) iptel -\> DOESN'T WORK, returns "No results found". How so?
d) "asterisk"iptel"asterisk" -\> works, return any field that contains substring "iptel"
e) attrs.from:iptel -\> DOESN'T WORK
f) attrs.from:iptel.org -\> works
I thought that I have specify that I want substring but if a) and b) returns substring I expect also c) to do it so.
attrs.from is searchable keyword that looks like "sip:3400017733@iptel.org".
Why c) and e) doesn't work?
---
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [October 13, 2017, 10:33am UTC](https://discuss.elastic.co/t/filter-field/103872/2 "2017-10-13T10:33:41Z")
What is you field type for attrs.from in _mapping_ ?
---
### Author:  [@Akaren](https://discuss.elastic.co/u/Akaren)
#### Post date: [October 13, 2017, 10:34am UTC](https://discuss.elastic.co/t/filter-field/103872/3 "2017-10-13T10:34:52Z")
string, searchable, analyzed...
---
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [October 13, 2017, 11:01am UTC](https://discuss.elastic.co/t/filter-field/103872/4 "2017-10-13T11:01:48Z")
> [@Akaren](#):
>
> "[sip:3400017733@iptel.org](mailto:sip:3400017733@iptel.org)"
Assuming your using the **standard analyzer** , your from field is analyzed as below.
```
POST test/_analyze
{
"analyzer" : "standard",
"text" : "sip:3400017733@iptel.org"
}
```
Above will be anaylzed as below,
```
{
"tokens": [
{
"token": "sip",
"start_offset": 0,
"end_offset": 3,
"type": "",
"position": 0
},
{
"token": "3400017733",
"start_offset": 4,
"end_offset": 14,
"type": "",
"position": 1
},
{
"token": "iptel.org",
"start_offset": 15,
"end_offset": 24,
"type": "",
"position": 2
}
]
}
```
**iptel** will not match any of the _token_ inside the inverted index. Thus **c)** and **e)** will not return anything.
---
### Author:  [@Akaren](https://discuss.elastic.co/u/Akaren)
#### Post date: [October 13, 2017, 11:08am UTC](https://discuss.elastic.co/t/filter-field/103872/5 "2017-10-13T11:08:54Z")
Oh, I see! ありがとうございました。
---
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [October 13, 2017, 11:29am UTC](https://discuss.elastic.co/t/filter-field/103872/6 "2017-10-13T11:29:55Z")
どういたしまして!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 10, 2017, 11:30am UTC](https://discuss.elastic.co/t/filter-field/103872/7 "2017-11-10T11:30:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.