# Kibana query string length limitation?

**URL:** <https://discuss.elastic.co/t/kibana-query-string-length-limitation/110562>\
**Category:** Kibana\
**Created:** [December 6, 2017, 6:53pm UTC](https://discuss.elastic.co/t/kibana-query-string-length-limitation/110562 "2017-12-06T18:53:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![brandondash](https://avatars.discourse-cdn.com/v4/letter/b/76d3ee/32.png) [@brandondash](https://discuss.elastic.co/u/brandondash)\
**Post date:** [December 6, 2017, 6:53pm UTC](https://discuss.elastic.co/t/kibana-query-string-length-limitation/110562/1 "2017-12-06T18:53:59Z")

</div>

I have a search that returns several tens of thousands of entries. I have one of the fields separated out as userID. In the userID string there exists a user's organization. There are a LOT of these organizations. For purposes of this question, we'll say each letter of the alphabet is an organization. So a sample userID would look something like this

```
Jonathan (Jon) Doe from A org

```

I would like to run an ad hoc query that returns users who belong in only... let's say 18... of of the organizations. My kibana query string looks roughly like this:

```
+type:"my-type" +"user is doing an event" !(userID: "A" "D" "E" "F" "M" "R" "S" "W")

```

The query works for the first several orgs I put in this list, but at some point the query just kinda... stops matching. The initial orgs are stripped from the results as expected, but eventually it stops filtering the results, so that given the above query I'll still get results like:

```
brandondash from W org

```

If I get rid of all the other orgs and only have "W" it successfully filters. It seems that the problem is related either to the length of the query string or the number of terms I am applying. What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [December 6, 2017, 7:18pm UTC](https://discuss.elastic.co/t/kibana-query-string-length-limitation/110562/2 "2017-12-06T19:18:40Z")

</div>

Hi Brandon,

Can you check the Request that Kibana is sending to Elasticsearch? I just want to make sure Kibana is sending the query we expect.

In Discover, click the little arrow to show the spy panel. Then select Request.

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/0/8002980f8ad3bc0241d09bca451c724ae2a63eba.png)

Thanks,  
Lee

---

<div class="post-metadata">

**Author:** ![brandondash](https://avatars.discourse-cdn.com/v4/letter/b/76d3ee/32.png) [@brandondash](https://discuss.elastic.co/u/brandondash)\
**Post date:** [December 6, 2017, 7:32pm UTC](https://discuss.elastic.co/t/kibana-query-string-length-limitation/110562/3 "2017-12-06T19:32:40Z")

</div>

```
{
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "require_field_match": false,
    "fragment_size": 2147483647
  },
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "+type:\"my-type\" +\"user is doing an event\" !(userID:\"A\" \"D\" \"E\" \"F\" \"M\" \"R\" \"S\" \"W\")",
            "analyze_wildcard": true
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1508644800000,
              "lte": 1511067599000,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "must_not": []
    }
  },
  "size": 0,
  "sort": [
    {
      "@timestamp": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1d",
        "time_zone": "America/New_York",
        "min_doc_count": 1
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    "@timestamp"
  ]
}
```

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [December 6, 2017, 9:15pm UTC](https://discuss.elastic.co/t/kibana-query-string-length-limitation/110562/4 "2017-12-06T21:15:38Z")

</div>

I don't think it's the length of the query string. I was able to use a query string like this just fine;

`!(geo.src: "ID" "BD" "NP" BR PH CN CA AO IN US GT DE PK HK CI ET KZ IR MM SD CO KE RU JP LK GB UZ LY "FR" "KR" PL KR BE EG TH TN UA ZM UY VE)`

When you say;

> [@brandondash](#):
>
> I'll still get results like:
> 
> brandondash from W org

Are you saying that the userID field of that result is `W`?

When you say

> [@brandondash](#):
>
> I have one of the fields separated out as userID.

Do you mean that the userID is a field in your index, or did you create a scripted field for it in Kibana?

Regards,  
Lee

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2018, 9:15pm UTC](https://discuss.elastic.co/t/kibana-query-string-length-limitation/110562/5 "2018-01-03T21:15:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.