# How to include "+" as part of search in Kibana

**URL:** <https://discuss.elastic.co/t/how-to-include-as-part-of-search-in-kibana/355295>\
**Category:** Kibana\
**Created:** [March 13, 2024, 9:04am UTC](https://discuss.elastic.co/t/how-to-include-as-part-of-search-in-kibana/355295 "2024-03-13T09:04:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![willie\_0983](https://avatars.discourse-cdn.com/v4/letter/w/3d9bf3/32.png) [@willie\_0983](https://discuss.elastic.co/u/willie_0983)\
**Post date:** [March 13, 2024, 9:04am UTC](https://discuss.elastic.co/t/how-to-include-as-part-of-search-in-kibana/355295/1 "2024-03-13T09:04:53Z")

</div>

Hi friends,

I'm trying to find docs that have timestamps of a particular time zone e.g. +13:00 but having trouble matching it properly.

It is matching times without the "+" in front.

I have a text field called message.content with the following mapping

```auto

{
  "wj-1": {
    "mappings": {
      "message.content": {
        "full_name": "message.content",
        "mapping": {
          "content": {
            "type": "text"
          }
        }
      }
    }
  }
}

```

Ingested following

```auto
POST wj-1/_doc
{
  "message":{
    "content": """{"someother time: 13:00 start: 2024-03-12T00:00:07+12:00 end"}"""
  }
}
POST wj-1/_doc
{
  "message":{
    "content": """{"someother time: 12:00 start: 2024-03-12T00:00:07+13:00 end"}"""
  }
}

```

I searche using Kibana Discover

```auto
message.content : "+13:00"

```

And got the response

```auto
    "hits": {
      "max_score": null,
      "hits": [
        {
          "_index": "wj-1",
          "_id": "mZb5No4B31f8CUBVXruD",
          "_version": 1,
          "_score": 0.9684832,
          "fields": {
            "message.content": [
              "{\"someother time: 13:00 start: 2024-03-12T00:00:07+12:00 end\"}"
            ]
          },
          "sort": [
            0.9684832
          ]
        },
        {
          "_index": "wj-1",
          "_id": "mpb5No4B31f8CUBVXrvV",
          "_version": 1,
          "_score": 0.9684832,
          "fields": {
            "message.content": [
              "{\"someother time: 12:00 start: 2024-03-12T00:00:07+13:00 end\"}"
            ]
          },
          "sort": [
            0.9684832
          ]
        }
      ]
    }

```

I only want mpb5No4B31f8CUBVXrvV since it have +13:00 and not mpb5No4B31f8CUBVXrvV as it only have 13:00

Also tried to query differently:

```auto
message.content : "\\+13:00"

```

Same result as above

```auto
message.content : *+13\:00*

```

No result

Help would be appreciated, thanks.

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [March 13, 2024, 10:48am UTC](https://discuss.elastic.co/t/how-to-include-as-part-of-search-in-kibana/355295/2 "2024-03-13T10:48:00Z")

</div>

Hi @willie_0983,

You should be able to escape characters in your query using a single backslash "". Does that give you the single result you want?

---

<div class="post-metadata">

**Author:** ![willie\_0983](https://avatars.discourse-cdn.com/v4/letter/w/3d9bf3/32.png) [@willie\_0983](https://discuss.elastic.co/u/willie_0983)\
**Post date:** [March 13, 2024, 8:01pm UTC](https://discuss.elastic.co/t/how-to-include-as-part-of-search-in-kibana/355295/3 "2024-03-13T20:01:07Z")

</div>

HI Carly, that's for the suggestion but escaping with a backslash "\" did not make a difference

 ![Screenshot 2024-03-14 at 8.58.24 AM](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9427fa29d12d993800bedc74eaa1de679e431cc.png)

---

<div class="post-metadata">

**Author:** ![jughosta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jughosta/32/107160_2.png) [@jughosta](https://discuss.elastic.co/u/jughosta)\
**Post date:** [March 14, 2024, 9:42am UTC](https://discuss.elastic.co/t/how-to-include-as-part-of-search-in-kibana/355295/4 "2024-03-14T09:42:25Z")

</div>

Hi @willie_0983,

Welcome to the community!

The field should be `keyword` type. Then you can add a filter in Query DSL format ([wildcard](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html) or [regexp](https://www.elastic.co/guide/en/elasticsearch/reference/current/regexp-syntax.html)). Examples:

```auto
{
  "query": {
     "wildcard": {
        "message_content.keyword": {
          "value": "*+13*"
        }
     }
  }
}

```

```auto
{
  "query": {
    "regexp": {
      "message_content.keyword": ".+\\+13.+"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![willie\_0983](https://avatars.discourse-cdn.com/v4/letter/w/3d9bf3/32.png) [@willie\_0983](https://discuss.elastic.co/u/willie_0983)\
**Post date:** [March 18, 2024, 2:47am UTC](https://discuss.elastic.co/t/how-to-include-as-part-of-search-in-kibana/355295/5 "2024-03-18T02:47:36Z")

</div>

Changing the type from "text" to "keyword" works

Much appreciate the help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2024, 2:48am UTC](https://discuss.elastic.co/t/how-to-include-as-part-of-search-in-kibana/355295/6 "2024-04-15T02:48:20Z")

</div>

Closed on April 15, 2024, 2:48am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.