# Issues with search query for Kibana + ES (5.4.0) **URL:** \ **Category:** Kibana\ **Created:** [July 9, 2017, 6:53am UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387 "2017-07-09T06:53:16Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Post date:** [July 9, 2017, 6:53am UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387/1 "2017-07-09T06:53:16Z")
I am sending metric via metricbeat to ES 5.4.0. But while hitting the below query in kibana, I am getting unexpected results. > system.filesystem.used.pct :\>0.9 NOT system.filesystem.mount\_point: "/home\_dir/\*" `NOT system.filesystem.mount_point: "/"` NOT system.filesystem.mount\_point: "/apps/logs" After this query, I expect that search results should not contain results with mount\_point: / But, i see them too in search results. ![](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e96153e7898c8b60e5577fa33b91ce3308930c54.png) ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [July 10, 2017, 2:42pm UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387/2 "2017-07-10T14:42:18Z")
Very strange, I tried a similar query, but it works as expected for me: ![](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b777562a3b1c593276a90d8dc9403984bd124c0b.png) ![](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c79b1ba010c3678fa4465d3dbc54e585a6bb4823.png) What happens if you simply query for `NOT system.filesystem.mount_point:\/` and `system.filesystem.mount_point:\/`? Do you get different results? Can you post a screenshot of that field? I want to make sure it's not analyzed ![](https://us1.discourse-cdn.com/elastic/original/3X/3/7/3764f72d319d95b8c25c32c99f41bb3cc07ccaca.png) ---
**Author:** ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Post date:** [July 10, 2017, 5:44pm UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387/3 "2017-07-10T17:44:15Z")
I see, in my case it is analyzed. I have another field system.filesystem.mount\_point.keyword which is not analyzed and when I try to search with that it is working fine. I dont understand how a field being analyzed can result in this while querying. ---
**Author:** ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Post date:** [July 10, 2017, 6:00pm UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387/4 "2017-07-10T18:00:18Z")
> [@Stacey\_Gammon](#): > > What happens if you simply query for **NOT system.filesystem.mount\_point:/** and **system.filesystem.mount\_point:/**? Do you get different results? For both of these, i get no results. ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [July 10, 2017, 6:19pm UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387/5 "2017-07-10T18:19:22Z")
Ah, the issue is because your field is analyzed. When the field is analyzed, it considers the `/` to indicate a new token (like the space character), so that the slash isn't indexed and can't be searched on. Can you change the field to not be analyzed? Did you manually change that? When I ran metricbeat v 5.4.3, the field was non-analyzed by default. ---
**Author:** ![Rupesh\_Ranjan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rupesh_ranjan/32/22283_2.png) [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Post date:** [July 11, 2017, 5:46am UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387/6 "2017-07-11T05:46:14Z")
No, i didnt change it manually. Infact i did not mention anywhere in my config for the field to be analyzed or not. I am using metricbeat 5.2.0 and passing it on to ES 5.4.0 via logstash 5.4.0. ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [July 11, 2017, 1:39pm UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387/7 "2017-07-11T13:39:11Z")
I recommend upgrading metricbeat to match the versions for the rest of the stack. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 8, 2017, 1:39pm UTC](https://discuss.elastic.co/t/issues-with-search-query-for-kibana-es-5-4-0/92387/8 "2017-08-08T13:39:29Z")
Closed on August 8, 2017, 1:39pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.