# Issue with KQL string query that has colon
**URL:** https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [October 16, 2019, 6:59pm UTC](https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912 "2019-10-16T18:59:42Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@thethomp](https://discuss.elastic.co/u/thethomp)
#### Post date: [October 16, 2019, 6:59pm UTC](https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912/1 "2019-10-16T18:59:42Z")
I'm trying to construct a simple query to match all logs lines that start with "Error: ", but when I try to search for this string, all lines that include the word 'error' (not case sensitive) anywhere in the string are returned. It doesn't seem to do anything with the colon in the string. I'd love it be case sensitive and take the colon into account with the query. If I can somehow indicate that the text should start with this string, that would be even better.
According to the KQL documentation, if I'm reading it right ([https://www.elastic.co/guide/en/kibana/7.1/kuery-query.html](https://www.elastic.co/guide/en/kibana/7.1/kuery-query.html)), I should be able to use this query to accomplish what I'm looking for:
`log_text: "Error: "`
But it doesn't return what I described. I tried a number of variations of this as well, hoping someone can guide me in the right direction here, I feel like I'm missing something minor. Thanks in advance.
---
### Author:  [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [October 17, 2019, 8:19pm UTC](https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912/2 "2019-10-17T20:19:35Z")
Hi Thomp,
Is `log_text` a text field or a keyword field?
---
### Author:  [@thethomp](https://discuss.elastic.co/u/thethomp)
#### Post date: [October 17, 2019, 9:38pm UTC](https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912/3 "2019-10-17T21:38:46Z")
Yep, it's a text field. I have a text and keyword version of the field. The keyword version is called `log_text.keyword`.
---
### Author:  [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [October 17, 2019, 11:20pm UTC](https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912/4 "2019-10-17T23:20:18Z")
Since text fields are analyzed, whatever you search will also be analyzed and special characters will be stripped.
In other words, even if you had other special characters in your query against `log_text`, you'd still get matches (since they're filtered out).
What you really want is to search against the keyword version of the field. I think you'll want something along the lines of
```auto
log_text.keyword: Error\:*
```
The `*` is a wildcard that means "anything after this", and the `\` escapes the colon so that it actually becomes part of the query.
---
### Author:  [@thethomp](https://discuss.elastic.co/u/thethomp)
#### Post date: [October 18, 2019, 12:23am UTC](https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912/5 "2019-10-18T00:23:02Z")
This did the trick, thanks so much!
I use keyword fields only for full text matches most of the time and it didn't occur to me that I could do a filter like this against it, but this is precisely what I needed.
Appreciate the help!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 15, 2019, 12:23am UTC](https://discuss.elastic.co/t/issue-with-kql-string-query-that-has-colon/203912/6 "2019-11-15T00:23:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.