# Kibana search d

**URL:** https://discuss.elastic.co/t/kibana-search-d/311809
**Category:** Kibana
**Created:** [August 10, 2022, 8:36am UTC](https://discuss.elastic.co/t/kibana-search-d/311809 "2022-08-10T08:36:54Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![cihady](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cihady](https://discuss.elastic.co/u/cihady)
#### Post date: [August 10, 2022, 8:36am UTC](https://discuss.elastic.co/t/kibana-search-d/311809/1 "2022-08-10T08:36:54Z")

</div>

I am searching for specific text in my logs  
text is $2a$10$Ltijvm9V  
in KQL search I wrote

`message.keyword : "$2a$10$Ltijvm9V2eA"`

it returns nothing and says expand your time rang but before search I can see the text.

Second problem: lets say a have a field named as message and I want to search a specific word in it so I wrote  
`message.keyword : "UserCorrelationFilter"`

again it returns nothing  
but I know that the text is there and that message is exists what is wrong with my searchs

---

<div class="post-metadata">

### Author: ![JLeysens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jleysens/32/67404_2.png) [@JLeysens](https://discuss.elastic.co/u/JLeysens)
#### Post date: [August 10, 2022, 8:42am UTC](https://discuss.elastic.co/t/kibana-search-d/311809/2 "2022-08-10T08:42:54Z")

</div>

Hello!

Would you mind sharing the full request you are sending?

---

<div class="post-metadata">

### Author: ![cihady](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cihady](https://discuss.elastic.co/u/cihady)
#### Post date: [August 10, 2022, 8:53am UTC](https://discuss.elastic.co/t/kibana-search-d/311809/3 "2022-08-10T08:53:07Z")

</div>

> [@cihady](#):
>
> message.keyword : "$2a$10$Ltijvm9V2eA"

I didnt understand, what is full request I just write this into search box

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c4f6a22adf247f72df1e355e3773cf01edf213e.png)

---

<div class="post-metadata">

### Author: ![JLeysens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jleysens/32/67404_2.png) [@JLeysens](https://discuss.elastic.co/u/JLeysens)
#### Post date: [August 10, 2022, 9:01am UTC](https://discuss.elastic.co/t/kibana-search-d/311809/4 "2022-08-10T09:01:46Z")

</div>

Thanks. A couple questions:

- It looks like you have a filter `75` - could that be filtering out some of the data you are hoping to see?
- With your `UserCorrelationFilter` example you should seeing results with `message: UserCorrelationFilter`. `message.keyword` is doing a search on a keyword type, not text.

---

<div class="post-metadata">

### Author: ![cihady](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@cihady](https://discuss.elastic.co/u/cihady)
#### Post date: [August 10, 2022, 9:06am UTC](https://discuss.elastic.co/t/kibana-search-d/311809/5 "2022-08-10T09:06:13Z")

</div>

I successfully search and get results.  
My mistake was there was $ sign in my search it directly fails and other characters like |(pipe) also may broke your search.

my other mistake was misuseage of " and \* signs  
let say we have a message like "asd dfetretgdg sfe safefa"  
and you want to search for messages that contains sfe word then you should write like `message: "sfe"`. if you want to search for a message that contains specific text then you should write like `message:*dfe*`

so how can I search a specific text that contains $ sign or | or \ or/ ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2022, 9:06am UTC](https://discuss.elastic.co/t/kibana-search-d/311809/6 "2022-09-07T09:06:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
