# Kibana filter incorrectly applied
**URL:** https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337
**Category:** Kibana
**Created:** [June 6, 2023, 12:11pm UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337 "2023-06-06T12:11:04Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [June 6, 2023, 12:11pm UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337/1 "2023-06-06T12:11:04Z")
Hello,
When we select this filter
It seems to apply not only to "update", but also for example to "update-security"....
Seems like a bug to me?
Willem
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [June 7, 2023, 9:34am UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337/2 "2023-06-07T09:34:49Z")
can you check the dsl that is generated ? (click edit query dsl in the filter)
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [June 7, 2023, 10:08am UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337/3 "2023-06-07T10:08:26Z")
The dsl filter:
```auto
{
"bool": {
"minimum_should_match": 1,
"should": [
{
"match_phrase": {
"infoblox_nios.log.dns.category": "update"
}
}
]
}
}
```
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [June 8, 2023, 9:30am UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337/4 "2023-06-08T09:30:47Z")
@lukas can you please take a look
---
### Author:  [@lukas](https://discuss.elastic.co/u/lukas)
#### Post date: [June 12, 2023, 9:30pm UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337/5 "2023-06-12T21:30:49Z")
Yes, this is expected, since (I'm assuming) `infoblox_nios.log.dns.category` is an analyzed field. If you want an exact match, you'll have to use the `keyword` version of the field.
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [July 1, 2023, 8:56pm UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337/6 "2023-07-01T20:56:45Z")
Honetly I have no clue what you mean this is expected. The filter says "match\_phrase", but it doesn't match at all? The field doesn't has a keyword version fyi.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 2, 2023, 12:53am UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337/7 "2023-07-02T00:53:29Z")
> [@willemdh](#):
>
> Honetly I have no clue what you mean this is expected. The filter says "match\_phrase", but it doesn't match at all?
This is expected because this field is mapped as a `text` field as you can check [here](https://github.com/elastic/integrations/blob/main/packages/infoblox_nios/data_stream/log/fields/fields.yml).
The field `infoblox_nios.log.dns.category` is mapped as `text` so it will be an analyzed field, in this case your query will match any document that has `updated` on it and not just documents that have only `update` but no `update-security`.
To have an exact match you would need the field to be mapped as `keyword`, you will also not have a `keyword` field because the mapping for it was not created.
It is not a bug, but in my opinion the mapping for this field seems to be wrong, if this represents a category with values like the ones you shared, this should've be mapped as a `keyword` field not a `text` field.
I think you should open an issue in the [integrations repository](https://github.com/elastic/integrations) so Elastic can look at it and change the mapping.
You could also try to use a [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-mapping-fields.html#runtime-fields-scriptless) to make this field behave like a `keyword` field, but beware that this can have a performance impact.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 30, 2023, 12:54am UTC](https://discuss.elastic.co/t/kibana-filter-incorrectly-applied/335337/8 "2023-07-30T00:54:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.