# Need help in writing DSL

**URL:** <https://discuss.elastic.co/t/need-help-in-writing-dsl/258451>\
**Category:** Elasticsearch\
**Created:** [December 11, 2020, 8:32pm UTC](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451 "2020-12-11T20:32:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vikas\_Rathore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_rathore/32/70471_2.png) [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\
**Post date:** [December 11, 2020, 8:32pm UTC](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451/1 "2020-12-11T20:32:54Z")

</div>

I searched a lot but couldn't able to write a proper KQL. I am trying to search a string "`error`" in `message` field AND field `kubernetes.pod.name` must contain `test-*`

I tried this but it's not working

```auto
{
  "size": 1,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "message": {
              "query": "error",
              "operator": "OR",
              "prefix_length": 0,
              "max_expansions": 50,
              "fuzzy_transpositions": true,
              "lenient": false,
              "zero_terms_query": "NONE",
              "auto_generate_synonyms_phrase_query": true,
              "boost": 1
            }
          }
        },
        {
          "match": {
            "kubernetes.pod.name": {
              "query": "test-*",
              "operator": "OR",
              "prefix_length": 0,
              "max_expansions": 50,
              "fuzzy_transpositions": true,
              "lenient": false,
              "zero_terms_query": "NONE",
              "auto_generate_synonyms_phrase_query": true,
              "boost": 1
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "from": "now-10000m",
              "to": null,
              "include_lower": true,
              "include_upper": true,
              "boost": 1
            }
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1
    }
  },
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![Vikas\_Rathore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_rathore/32/70471_2.png) [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\
**Post date:** [December 13, 2020, 1:47pm UTC](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451/2 "2020-12-13T13:47:31Z")

</div>

Mapping of the field is

```auto
    "mappings" : {
          "kubernetes.pod.name" : {
            "full_name" : "kubernetes.pod.name",
            "mapping" : {
              "name" : {
                "type" : "keyword",
                "ignore_above" : 1024
              }
            }
          }
        }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2021, 1:47pm UTC](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451/3 "2021-01-10T13:47:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.