# Match Strings Exactly Within A BOOL

**URL:** <https://discuss.elastic.co/t/match-strings-exactly-within-a-bool/202398>\
**Category:** Elasticsearch\
**Created:** [October 4, 2019, 11:00pm UTC](https://discuss.elastic.co/t/match-strings-exactly-within-a-bool/202398 "2019-10-04T23:00:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![drabid200](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@drabid200](https://discuss.elastic.co/u/drabid200)\
**Post date:** [October 4, 2019, 11:00pm UTC](https://discuss.elastic.co/t/match-strings-exactly-within-a-bool/202398/1 "2019-10-04T23:00:59Z")

</div>

I very much struggle with the elasticsearch synatx. I have a query that almost works except for exact string matching on the labels.system\_id values in the below example. Specifying "West-1-a" returns records for "North-West-1-a" as well as "West-1-a". How can I modify my query to limit my labels.system\_id to the exact strings I have within my "should" section? Willing to rearchitect the entire query, but just don't know how.

```
{
 "size" : 8000,
 "_source" : {
   "includes" : [
     "@timestamp", "labels.system_id", "labels.programNumber", "host.hostname", "container.name", "message"
   ]
 },
 "query" : {
   "bool" : {
     "must" :
       [
         { "match" : { "message" : "<SpliceInfoSection" } },
         { "match_phrase" : { "message" : "segmentationTypeId=55" } }
       ],
     "should" : [
       { "match_phrase" : { "labels.system_id" : "West_ATP-1-a" } },
       { "match_phrase" : { "labels.system_id" : "West_ATP-1-b" } }
     ],
     "minimum_should_match" : 1,
     "filter" : {
       "range" : {
         "@timestamp" : {
           "gte" : "2019-10-02T22:00:00.000Z",
           "lt" : "2019-10-03T02:00:00.000Z"
         }
       }
    }
   }
 }
}

```

**Matching Record excerpts:**

"labels": {  
"system\_id": "West\_ATP-1-b",  
"programNumber": "6"  
}

...

"labels": {  
"system\_id": "North-West\_ATP-1-b",  
"programNumber": "6"  
}

I've tried several things including modifying my filter, and using term. No luck.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![linkerc](https://avatars.discourse-cdn.com/v4/letter/l/13edae/32.png) [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Post date:** [October 5, 2019, 1:22am UTC](https://discuss.elastic.co/t/match-strings-exactly-within-a-bool/202398/2 "2019-10-05T01:22:42Z")

</div>

Use "labels.system\_id.keyword"

---

<div class="post-metadata">

**Author:** ![drabid200](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@drabid200](https://discuss.elastic.co/u/drabid200)\
**Post date:** [October 5, 2019, 3:48pm UTC](https://discuss.elastic.co/t/match-strings-exactly-within-a-bool/202398/3 "2019-10-05T15:48:26Z")

</div>

Thank you so much, that worked perfectly. I've got a lot more research to do on elasticsearch.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 6, 2019, 5:42am UTC](https://discuss.elastic.co/t/match-strings-exactly-within-a-bool/202398/4 "2019-10-06T05:42:34Z")

</div>

When you want to match exactly you should perhaps use a term search  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2019, 5:42am UTC](https://discuss.elastic.co/t/match-strings-exactly-within-a-bool/202398/5 "2019-11-03T05:42:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.