# Partial field value matching post Winlogbeat upgrade to 8.1
**URL:** https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222
**Category:** Beats
**Tags:** winlogbeat
**Created:** [March 21, 2022, 3:47pm UTC](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222 "2022-03-21T15:47:11Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Psyhil](https://discuss.elastic.co/u/Psyhil)
#### Post date: [March 21, 2022, 3:47pm UTC](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222/1 "2022-03-21T15:47:12Z")
Hi All,
We are using elk 7.17.1 with winlogbeat version 7.8 version with ECS version 1.5.
While testing out winlogbeat 8.1.0 with ECS version 8.0.0, now my lucene queries are now doing partial matches.
A simple example of Lucene query
```auto
winlog.event_data.Image:C\:\\Windows\\System32\\schtasks.exe
```
is doing partial matching the field winlog.event\_data.Image and listing anything with C or
```auto
C:\
C:\Windows\
C:\Windows\System32\
```
This behavior is not seen with data in indexes with winlogbeat agent 7.8
Expected matches were where field value is `C:\Windows\System32\schtasks.exe`
Did I miss something here?
Thank you in advance!
---
### Author:  [@Psyhil](https://discuss.elastic.co/u/Psyhil)
#### Post date: [March 22, 2022, 1:24pm UTC](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222/2 "2022-03-22T13:24:07Z")
Tried using Beats 7.17.1 version and seeing same issue, downgraded the winlogbeat to 7.8 and the queries started working normally.
Out of ideas what may have changed.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2022, 3:24pm UTC](https://discuss.elastic.co/t/partial-field-value-matching-post-winlogbeat-upgrade-to-8-1/300222/3 "2022-04-19T15:24:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.