# Kibana Timelion: how to query a specific value expression with space **URL:** \ **Category:** Kibana\ **Tags:** timelion\ **Created:** [May 10, 2018, 3:32pm UTC](https://discuss.elastic.co/t/kibana-timelion-how-to-query-a-specific-value-expression-with-space/131327 "2018-05-10T15:32:33Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![narschang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/narschang/32/20178_2.png) [@narschang](https://discuss.elastic.co/u/narschang)\ **Post date:** [May 10, 2018, 3:32pm UTC](https://discuss.elastic.co/t/kibana-timelion-how-to-query-a-specific-value-expression-with-space/131327/1 "2018-05-10T15:32:34Z")
Hello, I am on Kibana 6.2.4 and I couldn't get the following Timelion visualization working right. .es(index="bug\_elk\_prod", timefield="open\_date", q="( **found\_in\_rv: 'AGM 9.0'** ) AND (target\_rv:PARENT)").label("Found in AGM 9.0").color(#00BFFF).bars() The visualization of this query came out as same as my other Timelion visualization - in which q="( **found\_in\_rv: '9.0'** ) AND (target\_rv:PARENT)") the value "9.0" is the only difference. Please see the screenshot attached to this discussion. It seems like the query of 'AGM 9.0' didn't go through. How could I make it right to get the data associated with "AGM 9.0"? Thanks. ![47%20AM](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3b5e3fb0c370bfadbe0d230964e22f7070ff5350.png) ![32%20AM](https://us1.discourse-cdn.com/elastic/original/3X/8/7/87067d86a2122c66dd8951070b497518f37d8feb.png) Nars ---
**Author:** ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)\ **Post date:** [May 10, 2018, 5:22pm UTC](https://discuss.elastic.co/t/kibana-timelion-how-to-query-a-specific-value-expression-with-space/131327/2 "2018-05-10T17:22:04Z")
Try swapping the single and double quotes: > [@narschang](#): > > q="(found\_in\_rv: 'AGM 9.0') AND (target\_rv:PARENT)" q='(found\_in\_rv:"AGM 9.0") AND (target\_rv:PARENT)' ---
**Author:** ![narschang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/narschang/32/20178_2.png) [@narschang](https://discuss.elastic.co/u/narschang)\ **Post date:** [May 10, 2018, 6:02pm UTC](https://discuss.elastic.co/t/kibana-timelion-how-to-query-a-specific-value-expression-with-space/131327/3 "2018-05-10T18:02:02Z")
Hello Jen, Just tried it and it worked. Thanks a lot!! Nars ---
**Author:** ![narschang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/narschang/32/20178_2.png) [@narschang](https://discuss.elastic.co/u/narschang)\ **Post date:** [May 10, 2018, 6:31pm UTC](https://discuss.elastic.co/t/kibana-timelion-how-to-query-a-specific-value-expression-with-space/131327/4 "2018-05-10T18:31:57Z")
Got a follow up up question: .es(index="bug\_elk\_prod", timefield="open\_date", q='**(found\_in\_rv:"9.0" OR found\_in\_rv:"AGM 9.0")** AND target\_rv:PARENT').label("Found in 9.0 and AGM 9.0").color(#00BFFF).bars() The query (found\_in\_rv:"9.0" OR found\_in\_rv:"AGM 9.0") is picking up only the 9.0 data but not AGM 9.0 data. How do I make this OR expression right? Thanks a lot. Nars ---
**Author:** ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)\ **Post date:** [May 10, 2018, 6:58pm UTC](https://discuss.elastic.co/t/kibana-timelion-how-to-query-a-specific-value-expression-with-space/131327/5 "2018-05-10T18:58:39Z")
> [@narschang](#): > > (found\_in\_rv:"9.0" OR found\_in\_rv:"AGM 9.0") This looks correct. What is the mapping of `found_in_rv` field? If type is set to `text`, querying for `9.0` will match both `9.0` and `AGM 9.0` (so there is no need for the second `OR` condition. If type is set to `keyword`, querying for `9.0` will only match `9.0`. Elasticsearch may have created `found_in_rv.keyword` for you as well, so you can try: `(found_in_rv.keyword:"9.0" OR found_in_rv.keyword:"AGM 9.0")` More information here: [Timelion query - #2 by Stacey\_Gammon](https://discuss.elastic.co/t/timelion-query/107050/2) ---
**Author:** ![narschang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/narschang/32/20178_2.png) [@narschang](https://discuss.elastic.co/u/narschang)\ **Post date:** [May 10, 2018, 7:47pm UTC](https://discuss.elastic.co/t/kibana-timelion-how-to-query-a-specific-value-expression-with-space/131327/6 "2018-05-10T19:47:35Z")
Thank you, you are right. This euery is 9.0 and AGM 9.0 inclusive. It's now working after I changed my query from target\_rv:9.0 to target\_rv.keyword:9.0. Thank you!!! Nars ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 7, 2018, 7:47pm UTC](https://discuss.elastic.co/t/kibana-timelion-how-to-query-a-specific-value-expression-with-space/131327/7 "2018-06-07T19:47:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.