# How to search text existence in kibana using filter

**URL:** https://discuss.elastic.co/t/how-to-search-text-existence-in-kibana-using-filter/174728
**Category:** Kibana
**Created:** [April 1, 2019, 7:38am UTC](https://discuss.elastic.co/t/how-to-search-text-existence-in-kibana-using-filter/174728 "2019-04-01T07:38:29Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ankit\_aggarwal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankit_aggarwal/32/43183_2.png) [@ankit\_aggarwal](https://discuss.elastic.co/u/ankit_aggarwal)
#### Post date: [April 1, 2019, 7:38am UTC](https://discuss.elastic.co/t/how-to-search-text-existence-in-kibana-using-filter/174728/1 "2019-04-01T07:38:29Z")

</div>

Hi,

I have text in **data.msg** : "Generate Settlement Response SettlementResponseVO(settlementId=c540a785-6e0f-4e3f-aad9-8c92ef9d2511, locationId=6d86595c-7c44-4f8f-9b65-6826a27dc2fd, accountId=5055822b-c8f4-42fd-ba8c-c40be6dedce1, amount=0.0000, settlementDate=2019-04-01T07:11:03.045)"

but i know id "c540a785-6e0f-4e3f-aad9-8c92ef9d2511" which exist in text and there are 50 lack logs in kibana. So please help me how to search **data.msg** only having "c540a785-6e0f-4e3f-aad9-8c92ef9d2511" id.

---

<div class="post-metadata">

### Author: ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)
#### Post date: [April 1, 2019, 7:01pm UTC](https://discuss.elastic.co/t/how-to-search-text-existence-in-kibana-using-filter/174728/2 "2019-04-01T19:01:10Z")

</div>

I think you want to parse the `data.msg` field into separate fields at ingest. How are you ingesting your logs into Elasticsearch?

With Logstash, you could use the [Grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) to parse your string into different keywords. So your resulting document in Elasticsearch might look like

```json
{ 
  "settlementid": "c540a785-6e0f-4e3f-aad9-8c92ef9d2511",
  "locationid": "6d86595c-7c44-4f8f-9b65-6826a27dc2fd",
  "accountId": "5055822b-c8f4-42fd-ba8c-c40be6dedce1",
  "amount": 0.00,
  "settlementdate": "2019/04/01 11:03:45"
}

```

Then you can easily create a filter in Kibana on the `settlementid` field.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 29, 2019, 7:01pm UTC](https://discuss.elastic.co/t/how-to-search-text-existence-in-kibana-using-filter/174728/3 "2019-04-29T19:01:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
