# Query a range of values in phrase **URL:** \ **Category:** Kibana\ **Created:** [July 25, 2020, 8:48pm UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621 "2020-07-25T20:48:37Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Sahithi\_Muddasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahithi_muddasani/32/45310_2.png) [@Sahithi\_Muddasani](https://discuss.elastic.co/u/Sahithi_Muddasani)\ **Post date:** [July 25, 2020, 8:48pm UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621/1 "2020-07-25T20:48:37Z")
Hi I already have a log in the message field as below Message:Info matched and sent Http/1.2 200(345). Message:Info mismatch http/1.2 404(21) The value 200 is the status , but I don't have it in a separate field. How can I filter range of values in a text field. I'm trying to filter the logs based on their status. Please suggest me on this Thanks in advance. ---
**Author:** ![Dzmitry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dzmitry/32/65026_2.png) [@Dzmitry](https://discuss.elastic.co/u/Dzmitry)\ **Post date:** [July 27, 2020, 8:25am UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621/2 "2020-07-27T08:25:19Z")
Hi @Sahithi_Muddasani You can try using [wildcard query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html) ```auto {"query":{ "wildcard": { "message.keyword" : "*200*" }}} ``` You can also check [Regexp query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html), to compare and see what works better for you. Regards, Dzmitry ---
**Author:** ![Sahithi\_Muddasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahithi_muddasani/32/45310_2.png) [@Sahithi\_Muddasani](https://discuss.elastic.co/u/Sahithi_Muddasani)\ **Post date:** [July 27, 2020, 9:23am UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621/3 "2020-07-27T09:23:18Z")
Hi Dzmitry I tried using wildcard but it's giving me all the results which have 2 .I wanted to have only results that are followed by receive1.1 and should not also filter out if 2 is present in time i.e (28ms) I have message in the log as Info matched 2 , Post v/consumer/receive1.1 200(16ms). Info matched 2, post v/consumer/receive1.1 404 (28ms) So when I tried using \* it is giving me and ? Is not working here. ---
**Author:** ![Dzmitry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dzmitry/32/65026_2.png) [@Dzmitry](https://discuss.elastic.co/u/Dzmitry)\ **Post date:** [July 27, 2020, 2:22pm UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621/4 "2020-07-27T14:22:52Z")
You can try building a regular expression and use Regexp query to match your criteria, but it will make your search much slower. You can also create a [scripted field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html) with response code, but it still slows down your search experience. Creating a pipeline that adds a field with the response code based on your rules, then reindex documents and use field filtering in Discover. Fixing data design is a better way to make things work fast and reliable. Regards, Dzmitry ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [July 27, 2020, 2:29pm UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621/5 "2020-07-27T14:29:37Z")
I tried this scripted field but the format on some messages (space or no space between response code and "(" is different so this maybe isn't a good solution; In the index pattern, scripted fields tab, I added this number type scripted field. It finds the "(" char and then gets substring starting 3 chars in front of that and up to that "(". ```auto doc['Message.keyword'].value.substring(doc['Message.keyword'].value.indexOf("(")-3, doc['Message.keyword'].value.indexOf("(")) ``` ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/4/649c01b6bdf6f0bba86c5fdbf4b63d507caa0642.png) So it's really better to improve the ingest side to get the different parts of the message into separate fields. ---
**Author:** ![Sahithi\_Muddasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahithi_muddasani/32/45310_2.png) [@Sahithi\_Muddasani](https://discuss.elastic.co/u/Sahithi_Muddasani)\ **Post date:** [July 28, 2020, 7:14am UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621/6 "2020-07-28T07:14:32Z")
Thank you @Dzmitry and @LeeDr. I can't edit the data design so used scripted field and it worked perfectly for my requirement. ---
**Author:** ![Sahithi\_Muddasani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahithi_muddasani/32/45310_2.png) [@Sahithi\_Muddasani](https://discuss.elastic.co/u/Sahithi_Muddasani)\ **Post date:** [July 30, 2020, 9:22am UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621/7 "2020-07-30T09:22:33Z")
I created a scripted field "responsecode" Of number type. I'm unable to use this field to filter. Whenever I try, it says few shards failed. I'm storing a substring from message field in responsecode field. I assumed the particular substring is still in string format so I'm getting some error and tried parseInt method. Even that didn't work, I got result as . I checked for mapping of this particular field in index from console. Result was "Index":{ "Mappings:{} } I wanted to use the scripted field to filter based on range of response codes. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 27, 2020, 9:22am UTC](https://discuss.elastic.co/t/query-a-range-of-values-in-phrase/242621/8 "2020-08-27T09:22:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.