# How should i write query when i want to look for a specific value of a header from kibana logs?

**URL:** <https://discuss.elastic.co/t/how-should-i-write-query-when-i-want-to-look-for-a-specific-value-of-a-header-from-kibana-logs/155466>\
**Category:** Kibana\
**Created:** [November 5, 2018, 10:11pm UTC](https://discuss.elastic.co/t/how-should-i-write-query-when-i-want-to-look-for-a-specific-value-of-a-header-from-kibana-logs/155466 "2018-11-05T22:11:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SreeReddy](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@SreeReddy](https://discuss.elastic.co/u/SreeReddy)\
**Post date:** [November 5, 2018, 10:11pm UTC](https://discuss.elastic.co/t/how-should-i-write-query-when-i-want-to-look-for-a-specific-value-of-a-header-from-kibana-logs/155466/1 "2018-11-05T22:11:37Z")

</div>

For Example, how should my query be, if i want to look for specific values of X-Forwarded-For ? Below is teh value of log.Headers field and i have to parse till X-Forwarded-For field.

Tried the below query, but was not successful:

```auto
{
  "match_phrase_prefix": {
    "log.requestHeaders.X-Forwarded-For": "52*"
  }
}

```

log.Headers value:

```auto
X-Amzn-Trace-Id: [XXXX],Accept: [application/x-protobuf],Tracecontext: [273f0626b40a74bc35hgh45],X-B3-Traceid: [273f0626b4gye4620a7464jbc],X-Forwarded-Proto: [https],X-Client-Id: [traffic-generator],X-B3-Parentspanid: [23714f926ee86435hfhdg5f1],X-Forwarded-Port: [443],X-Request-Id: [273f0626b40a325r43drgd74bdf6c],X-Span-Id: [52ac273e53605fdjhfgcj465465350],Applicationid: [ETASK],Content-Type: [application/x-protobuf],X-B3-Spanid: [33ac37593e8dfhgfj56756749da15],X-Forwarded-For: [882.2457.36761.245678, 57680.116782.16731.19696],X-B3-Sampled: [0],User-Agent: [Apache-HttpClient/4.5.6 (Java/1.8.0_181)],Accept-Encoding: [gzip,deflate]

```

---

<div class="post-metadata">

**Author:** ![brooksjo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brooksjo/32/37534_2.png) [@brooksjo](https://discuss.elastic.co/u/brooksjo)\
**Post date:** [November 12, 2018, 9:15am UTC](https://discuss.elastic.co/t/how-should-i-write-query-when-i-want-to-look-for-a-specific-value-of-a-header-from-kibana-logs/155466/2 "2018-11-12T09:15:58Z")

</div>

> [@SreeReddy](#):
>
> For Example, how should my query be, if i want to look for specific values of [X-Forwarded-For](https://discuss.elastic.co/t/kibana-4-3-sending-x-forwarded-for-127-0-0-1-even-if-i-am-not-using-any-load-balancer-is-it-a-desired-behavior/37297) [essay autowriter](http://essaytyper.pro/)? Below is teh value of log.Headers field and i have to parse till X-Forwarded-For field.
> 
> Tried the below query, but was not successful:

> [@SreeReddy](#):
>
> `{ "match_phrase_prefix": { "log.requestHeaders.X-Forwarded-For": "52*" } }`

Hello Sreetheja,

I'm trying to write query which you mentioned. Would you be able to give a few log.Headers field details you're having while checking?

There are conditions where Kibana will endeavor to question for the config before approval being accessible, and in those cases it will nimbly deal with the approval mistake, which is presumably what I found in the last case when checking it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2018, 9:16am UTC](https://discuss.elastic.co/t/how-should-i-write-query-when-i-want-to-look-for-a-specific-value-of-a-header-from-kibana-logs/155466/3 "2018-12-10T09:16:11Z")

</div>

Closed on December 10, 2018, 9:16am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.