# Query returns non matching records

**URL:** <https://discuss.elastic.co/t/query-returns-non-matching-records/195184>\
**Category:** Elasticsearch\
**Created:** [August 14, 2019, 10:22am UTC](https://discuss.elastic.co/t/query-returns-non-matching-records/195184 "2019-08-14T10:22:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ManuMP](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manump/32/51842_2.png) [@ManuMP](https://discuss.elastic.co/u/ManuMP)\
**Post date:** [August 14, 2019, 10:22am UTC](https://discuss.elastic.co/t/query-returns-non-matching-records/195184/1 "2019-08-14T10:22:31Z")

</div>

Hi ,

I am using the following query to identify log entries having the message **"DeviceStatus changed to Idle"** within a period. But the query also returns the following messages

"Module State is changed to idle ModuleName : PA Previous State Idle"  
"Module State is changed to idle ModuleName : PM2 Previous State Idle"

{  
"query": {  
"bool":{  
"must":[  
{ "match":{  
"Message":"DeviceStatus changed to Idle"  
}  
},  
{ "range":{  
"@timestamp":{  
"gte":"2019-08-08T13:42:39.307Z",  
"lt":"2019-08-08T13:42:40.430Z"  
}  
}  
}  
]  
}  
}  
}

What changes should be made to get matching records?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 14, 2019, 10:27am UTC](https://discuss.elastic.co/t/query-returns-non-matching-records/195184/2 "2019-08-14T10:27:17Z")

</div>

hey,

note that the default operator for the match query is `OR`, see [https://www.elastic.co/guide/en/elasticsearch/reference/7.3/query-dsl-match-query.html#query-dsl-match-query-boolean](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/query-dsl-match-query.html#query-dsl-match-query-boolean)

If that is not your issue, please provide a fully reproducible example.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2019, 10:27am UTC](https://discuss.elastic.co/t/query-returns-non-matching-records/195184/3 "2019-09-11T10:27:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.