# How to match text fields which ends with .s3.amazonaws.com using KQL?
**URL:** https://discuss.elastic.co/t/how-to-match-text-fields-which-ends-with-s3-amazonaws-com-using-kql/316731
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [October 17, 2022, 6:15am UTC](https://discuss.elastic.co/t/how-to-match-text-fields-which-ends-with-s3-amazonaws-com-using-kql/316731 "2022-10-17T06:15:49Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@shi](https://discuss.elastic.co/u/shi)
#### Post date: [October 17, 2022, 6:15am UTC](https://discuss.elastic.co/t/how-to-match-text-fields-which-ends-with-s3-amazonaws-com-using-kql/316731/1 "2022-10-17T06:15:49Z")
We are trying to match [s3.amazonaws.com](http://s3.amazonaws.com) from the following text field which is indexed.
```auto
goto-desktop.s3.amazonaws.com
```
We found that
```auto
1. DNSQuery : *amazonaws*
```
matched [amazonaws.com](http://amazonaws.com)
goto-desktop.s3.[amazonaws.com](http://amazonaws.com)
```auto
2. DNSQuery : goto*
```
matched goto
goto-desktop.s3.amazonaws.com
```auto
3. DNSQuery : s3.amazonaws.com
```
matches [amazonaws.com](http://amazonaws.com)
goto-desktop.s3.[amazonaws.com](http://amazonaws.com)
```auto
4. DNSQuery : *desktop*
```
matches desktop.s3
goto-desktop.s3.amazonaws.com
```auto
5. DNSQuery : goto-desktop.s3.amazonaws.com
```
matches [goto-desktop.s3.amazonaws.com](http://goto-desktop.s3.amazonaws.com)
goto-desktop.s3.[amazonaws.com](http://amazonaws.com)
Please note that - and second . are not matched, but the first and third . matched.
How can we match any queries starting ending with [s3.amazonaws.com](http://s3.amazonaws.com) only.
When we tried to match the following
```auto
goto-desktop.s3amazonaws.com
```
using
```auto
6. DNSQuery : *.s3.amazonaws.com
```
we don't get any match.
How can we match all the queries which ends with **.s3.amazonaws.com**?
---
### Author:  [@Stratoula\_Kalafateli](https://discuss.elastic.co/u/Stratoula_Kalafateli)
#### Post date: [October 17, 2022, 6:28am UTC](https://discuss.elastic.co/t/how-to-match-text-fields-which-ends-with-s3-amazonaws-com-using-kql/316731/2 "2022-10-17T06:28:42Z")
Hey! Where exactly are you trying to filter documents with KQL in kibana? If you are using the search bar which is on the top of Discover, Dashboard and Lens applications
There are 2 ways to do it:
1. use the KQL bar and do something like:
```auto
text.keyword : *.s3.amazonaws.com
```
1. Create a DSL filter like that
```auto
{
"query": {
"query_string": {
"fields": [
"text.keyword"
],
"query": "*.s3.amazonaws.com"
}
}
}
```
---
### Author:  [@shi](https://discuss.elastic.co/u/shi)
#### Post date: [October 17, 2022, 7:36am UTC](https://discuss.elastic.co/t/how-to-match-text-fields-which-ends-with-s3-amazonaws-com-using-kql/316731/3 "2022-10-17T07:36:00Z")
> [@Stratoula\_Kalafateli](#):
>
> `text.keyword : *.s3.amazonaws.com`
When we searched on the keyword instead of the text field, it is working
Thank you 😄
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 14, 2022, 7:37am UTC](https://discuss.elastic.co/t/how-to-match-text-fields-which-ends-with-s3-amazonaws-com-using-kql/316731/4 "2022-11-14T07:37:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.