# Help with query

**URL:** <https://discuss.elastic.co/t/help-with-query/359929>\
**Category:** Kibana\
**Created:** [May 21, 2024, 2:21pm UTC](https://discuss.elastic.co/t/help-with-query/359929 "2024-05-21T14:21:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbuchan74](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@mbuchan74](https://discuss.elastic.co/u/mbuchan74)\
**Post date:** [May 21, 2024, 2:21pm UTC](https://discuss.elastic.co/t/help-with-query/359929/1 "2024-05-21T14:21:08Z")

</div>

Hi,

I am trying to query inside the message to search for anything that contains 'HTTP STATUS' But id like to query to find all results that begin with 4 i.e status=404 or if status=400.

I can search for a singular one by doing this - message : "_STATUS=404_"  
However if i change it to just 4 i get no results. Is there a way to be able to search for if the message contains STATUS=4 that will come back with any results that begin with 4?

---

<div class="post-metadata">

**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\
**Post date:** [May 21, 2024, 2:36pm UTC](https://discuss.elastic.co/t/help-with-query/359929/2 "2024-05-21T14:36:19Z")

</div>

Hi @mbuchan74, Welcome the Elastic community.

It seems you are using Kibana Query Language. You can use [wildcard](https://www.elastic.co/guide/en/kibana/current/kuery-query.html#_filter_for_documents_using_wildcards) like below

```auto
STATUS=4*

```

let me know if you're using any other query language.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 21, 2024, 2:46pm UTC](https://discuss.elastic.co/t/help-with-query/359929/3 "2024-05-21T14:46:56Z")

</div>

That being said if it's a number I'd do something like:

```
STATUS >= 400 AND STATUS < 500

```

---

<div class="post-metadata">

**Author:** ![mbuchan74](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@mbuchan74](https://discuss.elastic.co/u/mbuchan74)\
**Post date:** [May 21, 2024, 3:02pm UTC](https://discuss.elastic.co/t/help-with-query/359929/4 "2024-05-21T15:02:14Z")

</div>

> [@ashishtiwari1993](#):
>
> `STATUS=4*`

Hi i get no results from this, tried it standalone and with message : before it

To confirm the only place the HTTP STATUS=XXX shows up is in the message field.

---

<div class="post-metadata">

**Author:** ![mbuchan74](https://avatars.discourse-cdn.com/v4/letter/m/2bfe46/32.png) [@mbuchan74](https://discuss.elastic.co/u/mbuchan74)\
**Post date:** [May 21, 2024, 3:02pm UTC](https://discuss.elastic.co/t/help-with-query/359929/5 "2024-05-21T15:02:46Z")

</div>

Hi ,

Hi i get no results from this, tried it standalone and with message : before it

To confirm the only place the HTTP STATUS=XXX shows up is in the message field

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 21, 2024, 3:46pm UTC](https://discuss.elastic.co/t/help-with-query/359929/6 "2024-05-21T15:46:21Z")

</div>

You should extract the data from the text and create a structured document that will be then fast and more precise to use...

If you are using all the default behavior, I guess that `message` is a `text` field. May be you have a `message.keyword` field as well?

In which case, you could try something like:

```
message.keyword="*STATUS=4*"

```

But I'm really unsure and anyway that's definitely not the best way to use Elasticsearch...