# How to search Kibana for abc="def" in message string
**URL:** https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744
**Category:** Kibana
**Created:** [December 15, 2020, 5:29pm UTC](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744 "2020-12-15T17:29:42Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@dbaddorf](https://discuss.elastic.co/u/dbaddorf)
#### Post date: [December 15, 2020, 5:29pm UTC](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744/1 "2020-12-15T17:29:42Z")
I'm sure that this is a simple question, but I'm certainly a newbie. I can't seem to get the right syntax. I have syslog data in Elastic Search which looks like the following:
message:
\<190\>date=2020-12-15 time=12:17:09 devname="Firewall-600E-Primary" devid="FG6H0E5819905243" eventtime=1608052630382658600 tz="-0500" logid="1059028704" type="utm" subtype="app-ctrl" eventtype="signature" level="information"
I would like to use Kibana to search for **type="utm"** , but I can't figure out what I need to escape, how to handle the equal sign, etc. Some of attempts show messages like "Lucene syntax warning", "Error loading data - Expected :,\<..." and other attempts show all usage of "type" (in this example).
I would certainly appreciate someone pointing me in the right direction.
Thanks!
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 15, 2020, 11:19pm UTC](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744/2 "2020-12-15T23:19:57Z")
What have you tried so far?
Something like `"type=\"utm\""`?
---
### Author:  [@dbaddorf](https://discuss.elastic.co/u/dbaddorf)
#### Post date: [December 16, 2020, 1:32pm UTC](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744/3 "2020-12-16T13:32:58Z")
Mark, that worked! I wasn't quoting the entire search string - just the substring. Thanks so much!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 13, 2021, 1:33pm UTC](https://discuss.elastic.co/t/how-to-search-kibana-for-abc-def-in-message-string/258744/4 "2021-01-13T13:33:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.