# Kibana query searching for s3.amazonaws.com matches other keys as well unless double quoted
**URL:** https://discuss.elastic.co/t/kibana-query-searching-for-s3-amazonaws-com-matches-other-keys-as-well-unless-double-quoted/80906
**Category:** Kibana
**Created:** [April 1, 2017, 8:04pm UTC](https://discuss.elastic.co/t/kibana-query-searching-for-s3-amazonaws-com-matches-other-keys-as-well-unless-double-quoted/80906 "2017-04-01T20:04:16Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@gjws](https://discuss.elastic.co/u/gjws)
#### Post date: [April 1, 2017, 8:04pm UTC](https://discuss.elastic.co/t/kibana-query-searching-for-s3-amazonaws-com-matches-other-keys-as-well-unless-double-quoted/80906/1 "2017-04-01T20:04:16Z")
Hi all,
I've got an ES cluster that contains a heap of AWS events. One of the main fields I would like to search on is eventSource. In Kibana I have a number of filters saved, one of them is:
eventSource:s3.amazonaws.com
When I run this search in the discover field, I also get results for [ec2.amazonaws.com](http://ec2.amazonaws.com) which I don't understand. If I wrap the query string in double quotes, such as:
eventSource:"[s3.amazonaws.com](http://s3.amazonaws.com)"
The filter works correctly. Now that I've got it to work, I'd like to understand why the quotes are necessary? Looking at:
eventSource:s3.amazonaws.com
and
eventSource:ec2.amazonaws.com
I don't understand why quotes would be required, can anyone shed some light on the cause?
Thanks!
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 1, 2017, 10:21pm UTC](https://discuss.elastic.co/t/kibana-query-searching-for-s3-amazonaws-com-matches-other-keys-as-well-unless-double-quoted/80906/2 "2017-04-01T22:21:13Z")
Have a read of [https://www.elastic.co/guide/en/elasticsearch/reference/5.3/query-dsl-query-string-query.html#query-string-syntax](https://www.elastic.co/guide/en/elasticsearch/reference/5.3/query-dsl-query-string-query.html#query-string-syntax), it should help.
---
### Author:  [@gjws](https://discuss.elastic.co/u/gjws)
#### Post date: [April 2, 2017, 6:46am UTC](https://discuss.elastic.co/t/kibana-query-searching-for-s3-amazonaws-com-matches-other-keys-as-well-unless-double-quoted/80906/3 "2017-04-02T06:46:44Z")
Thank you for the link, however after reading it I still don't understand the effect I'm seeing. Here are some examples taken from the Dev Tools Console.
Example 1:
> GET /cwl-\*/\_search?pretty
> {
> "query": { "match": { "eventSource": "[s3.amazonaws.com](http://s3.amazonaws.com)" } }
> }
> .....
> {
> "took": 31,
> "timed\_out": false,
> "\_shards": {
> "total": 60,
> "successful": 60,
> "failed": 0
> },
> "hits": {
> "total": 41652,
> "max\_score": 3.0560331,
Example 2:
> GET /cwl-\*/\_search?pretty
> {
> "query": { "match": { "eventSource": "[ec2.amazonaws.com](http://ec2.amazonaws.com)" } }
> }
> .....
> {
> "took": 22,
> "timed\_out": false,
> "\_shards": {
> "total": 60,
> "successful": 60,
> "failed": 0
> },
> "hits": {
> "total": 41652,
> "max\_score": 2.9937177,
Example 3:
> GET /cwl-\*/\_search?pretty
> {
> "query": { "match": { "eventSource": "[rds.amazonaws.com](http://rds.amazonaws.com)" } }
> }
> .....
> {
> "took": 18,
> "timed\_out": false,
> "\_shards": {
> "total": 60,
> "successful": 60,
> "failed": 0
> },
> "hits": {
> "total": 1249,
> "max\_score": 7.096842,
Examples 1 and 2 both return the same number of documents, even thought they are completely different search strings.
Example 3, which looks pretty much the same as example 2 in my eyes, returns a completely different number of documents, as I would expect.
If example 3 had returned the same results as example 2 then I would have been less confused, but as it was completely different, I still don't get it!
---
### Author:  [@spalger](https://discuss.elastic.co/u/spalger)
#### Post date: [April 3, 2017, 7:35pm UTC](https://discuss.elastic.co/t/kibana-query-searching-for-s3-amazonaws-com-matches-other-keys-as-well-unless-double-quoted/80906/4 "2017-04-03T19:35:42Z")
Hey @gjws, the queries you show here are not the same as the queries that kibana executes. Is it possible that there is just a one-to-one mapping of s3 and ec2 events that doesn't exist for rds?
---
### Author:  [@gjws](https://discuss.elastic.co/u/gjws)
#### Post date: [April 7, 2017, 5:49am UTC](https://discuss.elastic.co/t/kibana-query-searching-for-s3-amazonaws-com-matches-other-keys-as-well-unless-double-quoted/80906/5 "2017-04-07T05:49:07Z")
Hi @spalger,
Sorry, I've been away for a few days. I'm not sure what you mean by a one-to-one mapping, do you mean the index mappings? How would I verify this?
Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 5, 2017, 6:01am UTC](https://discuss.elastic.co/t/kibana-query-searching-for-s3-amazonaws-com-matches-other-keys-as-well-unless-double-quoted/80906/6 "2017-05-05T06:01:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.