# In kibana(KQL), In the message field need to combine two conditions **URL:** \ **Category:** Kibana\ **Created:** [November 2, 2021, 3:25am UTC](https://discuss.elastic.co/t/in-kibana-kql-in-the-message-field-need-to-combine-two-conditions/288185 "2021-11-02T03:25:10Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![souji](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@souji](https://discuss.elastic.co/u/souji)\ **Post date:** [November 2, 2021, 3:25am UTC](https://discuss.elastic.co/t/in-kibana-kql-in-the-message-field-need-to-combine-two-conditions/288185/1 "2021-11-02T03:25:10Z")
Have text message like below in my index "POST /app/v1/fetch/abcdefgh HTTP/1.1" 404 NR route\_not\_found - "-" 0 0 0 - “10.0.0.0” “[example.xxx.xxx.com](http://example.xxx.xxx.com)" "-" - - 10.10.10.1:80 "POST /app/v1/fetch/abcdefgh HTTP/1.1" 200 route\_not\_found - "-" 0 0 0 - “10.0.0.0” “[example.xxx.xxx.com](http://example.xxx.xxx.com)" "-" - - 10.10.10.1:80 "POST /app/v1/fetch/abcdefgh HTTP/1.1" 200 route\_not\_found - "-" 0 0 0 - “10.0.0.0” “[example.xxx.xxx.com](http://example.xxx.xxx.com)" "-" - - 10.10.10.1:80 How can search from kibana only to get the records for other than 200 means errors and has example keyword ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 2, 2021, 5:33am UTC](https://discuss.elastic.co/t/in-kibana-kql-in-the-message-field-need-to-combine-two-conditions/288185/2 "2021-11-02T05:33:07Z")
Ideally you would be extracting the fields during index time, using an ingest pipeline or similar. If not, you can try to use [a runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/7.15/runtime-mapping-fields.html) to pull the events apart and put them in their own fields. But it's likely to be a lot clunkier. I'm not sure if kql can pull this apart like you want. ---
**Author:** ![souji](https://avatars.discourse-cdn.com/v4/letter/s/65b543/32.png) [@souji](https://discuss.elastic.co/u/souji)\ **Post date:** [November 2, 2021, 12:15pm UTC](https://discuss.elastic.co/t/in-kibana-kql-in-the-message-field-need-to-combine-two-conditions/288185/3 "2021-11-02T12:15:21Z")
thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 30, 2021, 12:15pm UTC](https://discuss.elastic.co/t/in-kibana-kql-in-the-message-field-need-to-combine-two-conditions/288185/4 "2021-11-30T12:15:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.