Query on KQL to get an exact match

hi all,
im running elastic 7.6 and kibana 7.6. Im getting logs from my 2 servers tomcat and i use filebeat to send them directly to elasticseach..
doing it i added some custom fields: project
the project field is populated like that (for example):

  • myproject-platform-backend
  • myproject2-platform-backend
  • platform-backend

when i add this on the discovery -> query:
fields.project : "platform-backend"

i expect to see only my logs coming from this tomcat here.... but i see also the logs from the other 2...

the : is an exact match from the docs... what am i doing wrong ?


Is the project field mapped as a text field? If you want to do exact matches, it's recommended to use a keyword indexed field, then the query should only return the third document.

this is mapping i've got:
"project": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
"type": "text"

looks to be keyword...

This means “project” is a text field, but there is a keyword indexed version of the same field called “project.keyword”. Try filtering on the second one, that should work as you expect.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.