# Finding inaccurate data entry

**URL:** <https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766>\
**Category:** Kibana\
**Created:** [June 13, 2018, 4:28pm UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766 "2018-06-13T16:28:41Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Humornoy](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@Humornoy](https://discuss.elastic.co/u/Humornoy)\
**Post date:** [June 13, 2018, 4:28pm UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766/1 "2018-06-13T16:28:41Z")

</div>

I can not understand how to use a type filter like LIKE in SQL?  
I have this filed:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e24fbfa626fa0b581abaa80f8011206ce9949a13.png)  
And try to find all documents, where Acronym LIKE "%CDeviceBufferManager::UpdateBuffer\_Locked%", but i have no result. What syntax should i use?  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a67a5e64a9678d6261bd57c7fddd16826c713ddb.png)

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [June 13, 2018, 6:31pm UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766/2 "2018-06-13T18:31:49Z")

</div>

Hey @Humornoy, using the "query bar" at the top of Discover, you can use something similar to the following: `Acronym:"*CDeviceBufferManager::UpdateBuffer_Locked*"`.

 ![57%20PM](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8337e97eec1229040a4a6a15537481bf29426d7.png)

---

<div class="post-metadata">

**Author:** ![Humornoy](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@Humornoy](https://discuss.elastic.co/u/Humornoy)\
**Post date:** [June 14, 2018, 1:10pm UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766/3 "2018-06-14T13:10:19Z")

</div>

Doesnt work

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11521741e88ec9248fca021b00bed6aa3854df04.png)

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [June 14, 2018, 3:58pm UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766/4 "2018-06-14T15:58:48Z")

</div>

Would you mind confirming whether the `Acronym` field is a keyword or a text field? If you go to Management -\> Index Patterns and then locate your field, if you see it being denoted as "aggregatable" then it's a "keyword" field (which is unanalyzed) and if you see it as not being aggregatable, then it's a "text" field.

Elasticsearch handles text and keyword fields differently, and this relates towards the different ways that you can query them.

---

<div class="post-metadata">

**Author:** ![Humornoy](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@Humornoy](https://discuss.elastic.co/u/Humornoy)\
**Post date:** [June 15, 2018, 10:14am UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766/5 "2018-06-15T10:14:10Z")

</div>

> [@Brandon\_Kobel](#):
>
> if you see it being denoted as "aggregatable" then it's a "keyword" field (which is unanalyzed) and if you see it as not being aggregatable, then it's a "text" field.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e6c84bdd3adb22ee5bc2b390f176b3fd539b0c1.png)  
It's aggregatable

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [June 15, 2018, 12:57pm UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766/6 "2018-06-15T12:57:53Z")

</div>

In that case, try `Acronym:*CDeviceBufferManager::UpdateBuffer_Locked*` (without the quotes)

---

<div class="post-metadata">

**Author:** ![Humornoy](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@Humornoy](https://discuss.elastic.co/u/Humornoy)\
**Post date:** [June 15, 2018, 3:52pm UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766/7 "2018-06-15T15:52:55Z")

</div>

> [@Brandon\_Kobel](#):
>
> `Acronym:*CDeviceBufferManager::UpdateBuffer_Locked*`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/4/6400626e7ea4231913b39106fa625f19a27b95c0.png)  
Failed to parce query

P.S. thank you for help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2018, 3:53pm UTC](https://discuss.elastic.co/t/finding-inaccurate-data-entry/135766/8 "2018-07-13T15:53:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
