# How Query string pattern in kibana in simple syntax query space

**URL:** <https://discuss.elastic.co/t/how-query-string-pattern-in-kibana-in-simple-syntax-query-space/179773>\
**Category:** Kibana\
**Created:** [May 6, 2019, 12:58pm UTC](https://discuss.elastic.co/t/how-query-string-pattern-in-kibana-in-simple-syntax-query-space/179773 "2019-05-06T12:58:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![adg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adg/32/45618_2.png) [@adg](https://discuss.elastic.co/u/adg)\
**Post date:** [May 6, 2019, 12:58pm UTC](https://discuss.elastic.co/t/how-query-string-pattern-in-kibana-in-simple-syntax-query-space/179773/1 "2019-05-06T12:58:08Z")

</div>

Currently, we are using ELK stack for analysis of access logs  
but we are not able to query specific pattern in field ex  
in URL field there I have to filter only those URL how to have  
/topic/something-something/public  
/topic/something-nothing/public  
/topic/something-one-thing/public  
/topic/something-anything/public  
/topic/something-many-thing/public  
etc.  
not these  
/topic/hello  
/topic/world  
/public/hello  
/public/world

how can I do that in Kibana dashboard's simple syntax query space  
I am using **ELK stack 6.3.2**

Thanks in advance

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [May 10, 2019, 2:32pm UTC](https://discuss.elastic.co/t/how-query-string-pattern-in-kibana-in-simple-syntax-query-space/179773/2 "2019-05-10T14:32:24Z")

</div>

Hi adg,

The first thing to understand is the difference between `text` and `keyword` fields.

`text` = `analyzed` (split by spaces and slashes into individual terms)  
`keyword` = `unanalyzed`, sometimes also called `raw` (not split)

By example, here's a URL in an index of mine that shows 2 variations. One has `.analyzed` on the end which is indicating it's text which has been analyzed. That means it was parsed into terms by breaking the whole string up by spaces, slashes, and other non-alpha characters. The other is a keyword which means it's not broken up.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a1096f3d66dad4afc468fbf1ad83dbd1d3641a5e.png)

So in Discover, if I want to specify a whole expression to match a URL, I would use that unanalyzed build.console-url field and use backslashes to escape the forwards slashes and the `:`. I'm leaving a `*` on the end as a wildcard.

`build.console-url:https\:\/\/beats-ci.elastic.co\/job\/elastic+beats+pull-request+multijob-windows*`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/8/a81953d5bcd4ebfe44a6d2f0637e905cd1ce0515.png)

So if you have the raw field in your mapping, you would use that with a query like;  
`\/topic\/something-*\/public`

This blog doesn't cover escaping the slashes specifically, but has a lot of relevant info on the topic;

> **[Elasticsearch/Kibana Queries - In Depth Tutorial](https://www.timroes.de/elasticsearch-kibana-queries-in-depth-tutorial)**
>
> This tutorial explains how to write and understand Kibana and Elasticsearch queries
> in depth and how the mapping of Elastichsearch influences these queries.

Regards,  
Lee

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2019, 2:32pm UTC](https://discuss.elastic.co/t/how-query-string-pattern-in-kibana-in-simple-syntax-query-space/179773/3 "2019-06-07T14:32:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.