# Finding whole terms
**URL:** https://discuss.elastic.co/t/finding-whole-terms/114003
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [January 4, 2018, 2:43am UTC](https://discuss.elastic.co/t/finding-whole-terms/114003 "2018-01-04T02:43:49Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jnpetty](https://discuss.elastic.co/u/jnpetty)
#### Post date: [January 4, 2018, 2:43am UTC](https://discuss.elastic.co/t/finding-whole-terms/114003/1 "2018-01-04T02:43:50Z")
I am having trouble setting up a watcher so it looks for a whole term instead of individual words. For example if I had a message that contained "The red hat hung on the hook" and wanted watcher to send an email every time it found the words "red hat". Not "red" or "hat" or "hat red", I only want "red hat". How would I setup the input.
Currently I have something similar to the following:
```
"input": {
"search": {
"request": {
"indices": [
"red-hat-index-*"
],
"body": {
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "red hat"
}
},
{
"range": {
"@timestamp": {
"gte": "now-10m"
}
}
}
]
}
},
"_source": [
"message"
],
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
}
}
}
```
What am I missing in this input??
Bonus question, what if I wanted to find all messages with "red hat", but only the ones where the field "type" is equal to "red\_hat\_logs"?
Thanks!
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 4, 2018, 9:18am UTC](https://discuss.elastic.co/t/finding-whole-terms/114003/2 "2018-01-04T09:18:12Z")
Please take the time to format your messages properly, this JSON is super hard to read and markdown has excellent support for code snippets.
This is actually not a watcher issue, but rather a question how to write a proper query in the first place. You may want to read about [phrase queries](https://www.elastic.co/guide/en/elasticsearch/reference/6.1/query-dsl-query-string-query.html) in the `query_string` query how to make this works.
On top of that you can specify the type you want to query as part of the search input.
Hope this helps!
--Alex
---
### Author:  [@jnpetty](https://discuss.elastic.co/u/jnpetty)
#### Post date: [January 4, 2018, 4:11pm UTC](https://discuss.elastic.co/t/finding-whole-terms/114003/3 "2018-01-04T16:11:27Z")
The link you provided isnt clicking in my head. At the top of page it says that it will treat `"field:new york AND city"` as splited terms`"new"`, `"york"` and `"city"`
But at the bottom is contradicts that by saying `author:"John Smith"` will treat it as the exact phrase. So this isnt making sense.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 5, 2018, 8:01am UTC](https://discuss.elastic.co/t/finding-whole-terms/114003/4 "2018-01-05T08:01:45Z")
it depends if you are using double ticks or not. If you do, the query will become a phrase query.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 2, 2018, 8:01am UTC](https://discuss.elastic.co/t/finding-whole-terms/114003/5 "2018-02-02T08:01:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.