# Query not working as intended?

**URL:** <https://discuss.elastic.co/t/query-not-working-as-intended/100178>\
**Category:** Kibana\
**Created:** [September 12, 2017, 9:00am UTC](https://discuss.elastic.co/t/query-not-working-as-intended/100178 "2017-09-12T09:00:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mberger1](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@mberger1](https://discuss.elastic.co/u/mberger1)\
**Post date:** [September 12, 2017, 9:00am UTC](https://discuss.elastic.co/t/query-not-working-as-intended/100178/1 "2017-09-12T09:00:22Z")

</div>

Hey there.

The following Query is not working as I expect it to. Message is a string field.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e4ffc3d29353ad6126f8dad351ed1ad79f51d7c7.png)  
Should this not only show me those messages, which containt the String "RCV[" ?

---

<div class="post-metadata">

**Author:** ![timroes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timroes/32/19712_2.png) [@timroes](https://discuss.elastic.co/u/timroes)\
**Post date:** [September 12, 2017, 12:35pm UTC](https://discuss.elastic.co/t/query-not-working-as-intended/100178/2 "2017-09-12T12:35:30Z")

</div>

Hey,

I assume your "Message" field is _analyzed_ (otherwise the search result should be different)?

Analyzed values are splitted up on indexing at some word boundaries (e.g. special signs like brackets). That way, the value you are actually searching in, doesn't contain those brackets anymore, and such the query will also be stripped of them, leaving you to just search for RCV, which will match all the documents, that you need.

If you want to search for values including those brackets, you would need an non analyzed field. If you are using Elasticsearch 5 and above, there should be a field named `Message.keyword`, which contains the non analyzed value. To search for what you want, you would need to search for:

```auto
Message.keyword:RCV\[*

```

You need to escape the bracket with a backslash, otherwise the query would be invalid. You also need to suffix the `*` so it won't just search for exact matches, but also for values beginning with that substring.

In contrast, if you search for `Message.keyword:"RCV\[*"`, you would really search for fields, that contain the exact string `RCV\[*` in it (including the backslash and the asterisk).

I tried to sum how the analyzing and mapping of strings influence querying in a [blogpost](https://www.timroes.de/2016/05/29/elasticsearch-kibana-queries-in-depth-tutorial/).

Cheers,  
Tim

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2017, 12:35pm UTC](https://discuss.elastic.co/t/query-not-working-as-intended/100178/3 "2017-10-10T12:35:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.