# How to use slash ('/') to search in Discovery?

**URL:** <https://discuss.elastic.co/t/how-to-use-slash-to-search-in-discovery/92340>\
**Category:** Kibana\
**Created:** [July 7, 2017, 11:55pm UTC](https://discuss.elastic.co/t/how-to-use-slash-to-search-in-discovery/92340 "2017-07-07T23:55:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![palexvs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/palexvs/32/19863_2.png) [@palexvs](https://discuss.elastic.co/u/palexvs)\
**Post date:** [July 7, 2017, 11:55pm UTC](https://discuss.elastic.co/t/how-to-use-slash-to-search-in-discovery/92340/1 "2017-07-07T23:55:42Z")

</div>

I'm testing ELK stack for nginx-access logs. It looks good except I have not found a way to search records in Kibana Discovery (v5.3.2) with a path that contains '/test/a'. Search works if I remove slashes, but in this case, I get more records that I need (`ff/testtt/sss`, '/ololo/oolo?testtestt', ...)

I tried different requests:

```
path:/\/test\/a/
path:/\\/test\\/a/
path:"/test/a"
path:"\/test\/a"
path:"\\/test\\/a"

```

but nothing works as I expect.

Records:

```
[
{
    ...
    "path": "/test/a1"
    ...
},
{
    ...
    "path": "/test/a2"
    ...
},
{
    ...
    "path": "/ololo/ololo?testtest"
    ...
},        
]

```

Mapping:

```
"path": {
  "type": "string", 
  "index": "analyzed", 
},

```

Is there any way to search using slashes as part of pattern?

---

<div class="post-metadata">

**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\
**Post date:** [July 10, 2017, 1:35pm UTC](https://discuss.elastic.co/t/how-to-use-slash-to-search-in-discovery/92340/2 "2017-07-10T13:35:00Z")

</div>

The issue is because the field is being tokenized using the standard analyzer. If you have a non-analyzed version you can search for an escaped substring.

Here my query is being tokenized so the slash gets removed, and the tokens match the tokens in the field, but not the slash (so as you mention, it will match more than you want)

 ![](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0ab9052982acb77dd802280b89ca7f474639e7e7.png)

Here I am searching on the non-analyzed version of the field, so I can search an exact substring. Using `*` in the query causes the query to not be analyzed to my slashes are preserved.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5dfb5b1ff90c33e50553d0ac6691b8bc80edbe41.png)

Here you can see the two fields are indexed differently:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/2/0/205a37de2914bde7ce41d3ef56db02e09555d392.png)

Hope this helps!

---

<div class="post-metadata">

**Author:** ![annizaki](https://avatars.discourse-cdn.com/v4/letter/a/46a35a/32.png) [@annizaki](https://discuss.elastic.co/u/annizaki)\
**Post date:** [July 10, 2017, 3:29pm UTC](https://discuss.elastic.co/t/how-to-use-slash-to-search-in-discovery/92340/3 "2017-07-10T15:29:32Z")

</div>

For anyone else interested, this question was also answered on [stackoverflow.com](http://stackoverflow.com) and the solution given seemed to work:

> <https://stackoverflow.com/questions/44981143/how-to-use-slash-in-kibana-discovery>

---

<div class="post-metadata">

**Author:** ![palexvs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/palexvs/32/19863_2.png) [@palexvs](https://discuss.elastic.co/u/palexvs)\
**Post date:** [July 10, 2017, 4:43pm UTC](https://discuss.elastic.co/t/how-to-use-slash-to-search-in-discovery/92340/4 "2017-07-10T16:43:06Z")

</div>

I don't have `path.raw` field, hot to create it?

---

<div class="post-metadata">

**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\
**Post date:** [July 10, 2017, 5:58pm UTC](https://discuss.elastic.co/t/how-to-use-slash-to-search-in-discovery/92340/5 "2017-07-10T17:58:25Z")

</div>

You can create `path.raw` by changing `path` field to be a multi-field, so it has both the analyzed and non-analyzed versions. Doesn't have to be `raw`. You can read more about setting that up here: [https://www.elastic.co/guide/en/elasticsearch/reference/5.5/multi-fields.html#multi-fields](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/multi-fields.html#multi-fields).

If you don't need the analyzed version though, you can also just change `path` to be non analyzed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2017, 5:58pm UTC](https://discuss.elastic.co/t/how-to-use-slash-to-search-in-discovery/92340/6 "2017-08-07T17:58:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.