# Match\_phrase isn't precise

**URL:** <https://discuss.elastic.co/t/match-phrase-isnt-precise/113569>\
**Category:** Elasticsearch\
**Created:** [December 29, 2017, 10:48am UTC](https://discuss.elastic.co/t/match-phrase-isnt-precise/113569 "2017-12-29T10:48:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 29, 2017, 10:48am UTC](https://discuss.elastic.co/t/match-phrase-isnt-precise/113569/1 "2017-12-29T10:48:07Z")

</div>

this is my REST API:

```
GET logstash-2017.12.29/_search
{
"_source": {
  "includes": ["IPV4_DST_ADDR","IPV4_SRC_ADDR","IN_BYTES","OUT_BYTES"]
},
"size" : 100,
"query": {
"bool": {
  "should": [
    {
        "match_phrase":{"IPV4_DST_ADDR":"192.168.0.159"}
    },
    {
        "match_phrase":{"IPV4_SRC_ADDR":"192.168.0.159"}
    }
  ],
"must":
    {
      "range" : {
        "LAST_SWITCHED" : {
            "gte" : 1514543547
        }
        }
    }
}
},
"aggs": {
  "IN_PKTS": {
    "sum": {
      "field": "IN_PKTS"
    }
  },
  "IN_BYTES": {
    "sum": {
      "field": "IN_BYTES"
    }
  },
  "OUT_BYTES": {
    "sum": {
      "field": "OUT_BYTES"
    }
  },
  "OUT_PKTS": {
    "sum": {
      "field": "OUT_PKTS"
    }
  },
  "genres":{
    "terms" : {
            "field" : "L7_PROTO_NAME.keyword",
            "order" : { "in_bytes" : "desc" }
        },
    "aggs":{
      "in_bytes": {
      "sum": { "field":"IN_BYTES"}
    }
    }
  },
  "download1" : {
        "filter" : { "term": { "IPV4_DST_ADDR":"192.168.0.159"} },
        "aggs" : {
            "downlod_bytes" : { "sum" : { "field" : "IN_BYTES" } }
        }
    },
    "download2" : {
        "filter" : { "term": { "IPV4_SRC_ADDR":"192.168.0.159"} },
        "aggs" : {
            "downlod_bytes" : { "sum" : { "field" : "OUT_BYTES" } }
        }
    },"upload1" : {
        "filter" : { "term": { "IPV4_DST_ADDR":"192.168.0.159"} },
        "aggs" : {
            "downlod_bytes" : { "sum" : { "field" : "OUT_BYTES" } }
        }
    },"upload2" : {
        "filter" : { "term": { "IPV4_SRC_ADDR":"192.168.0.159"} },
        "aggs" : {
            "downlod_bytes" : { "sum" : { "field" : "IN_BYTES" } }
        }
    },
    "Udp|Tcp" : {
         "terms" : {
             "field" : "PROTOCOL"  
            }
  },
    "Using_port_count" : {                 
        "cardinality" : {
            "field" : "L4_SRC_PORT"
        }
    }
}   
}

```

I found there are some return documents didn't meet my requirement.

{  
"\_index": "logstash-2017.12.29",  
"\_type": "ntopng-\*",  
"\_id": "AWCh1jPtnZ2m3739FTU7",  
"\_score": 1,  
"\_source": {  
"IPV4\_SRC\_ADDR": "192.168.0.109", // not in my expectation  
"IN\_BYTES": 132,  
"IPV4\_DST\_ADDR": "224.0.0.252", // not in my expectation  
"OUT\_BYTES": 0  
}  
}

How should I modified my REST API .  
thank you in advance!

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 30, 2017, 7:39am UTC](https://discuss.elastic.co/t/match-phrase-isnt-precise/113569/2 "2017-12-30T07:39:18Z")

</div>

sorry does anyone has answer 🙂

---

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [December 30, 2017, 8:50am UTC](https://discuss.elastic.co/t/match-phrase-isnt-precise/113569/3 "2017-12-30T08:50:20Z")

</div>

The answer is here: [https://stackoverflow.com/questions/48032095/match-phrase-isn-t-precise](https://stackoverflow.com/questions/48032095/match-phrase-isn-t-precise) 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 27, 2018, 8:50am UTC](https://discuss.elastic.co/t/match-phrase-isnt-precise/113569/4 "2018-01-27T08:50:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.