# How to search file path field value in Kibana?
**URL:** https://discuss.elastic.co/t/how-to-search-file-path-field-value-in-kibana/325538
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [February 15, 2023, 4:51am UTC](https://discuss.elastic.co/t/how-to-search-file-path-field-value-in-kibana/325538 "2023-02-15T04:51:59Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@First\_Last](https://discuss.elastic.co/u/First_Last)
#### Post date: [February 15, 2023, 4:51am UTC](https://discuss.elastic.co/t/how-to-search-file-path-field-value-in-kibana/325538/1 "2023-02-15T04:51:59Z")
New to Kibana and need some help understanding escaping special characters. Basically what I'm trying to do is take what I know in splunk and wildcard searching substrings of eventlog fields. Below is what I tried but replaced the actual file names with example.
I ingested some events with winlogbeat and verified that I can see data by adding a filter for winlog.event\_id:1 and saw only those relevant events. To practice KQL, I put process.command\_line:\*example\* and saw that the events were narrowed down to command line with that in the string. I saw that C:\WINDOWS\system32\example.exe was part of some of the events so I changed it to process.command\_line:\*system32\\example\* to narrow it down further and escaping the backslash, but no results.
I'm still learning the Elasticsearch. Below is a portion from the request when I inspected.
```auto
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"should": [
{
"wildcard": {
"process.command_line": "*system32\\wsl*"
}
}
],
"minimum_should_match": 1
}
},
```
What am I missing?
I saw similar posts saying to add further escapes. I tried 4 backslashes but no results still. 3 backslashes returns a search error.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 15, 2023, 4:52am UTC](https://discuss.elastic.co/t/how-to-search-file-path-field-value-in-kibana/325538/2 "2023-03-15T04:52:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.