# Query string "OR" on a field

**URL:** <https://discuss.elastic.co/t/query-string-or-on-a-field/146639>\
**Category:** Elasticsearch\
**Created:** [August 30, 2018, 7:59am UTC](https://discuss.elastic.co/t/query-string-or-on-a-field/146639 "2018-08-30T07:59:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![espogian](https://avatars.discourse-cdn.com/v4/letter/e/4491bb/32.png) [@espogian](https://discuss.elastic.co/u/espogian)\
**Post date:** [August 30, 2018, 7:59am UTC](https://discuss.elastic.co/t/query-string-or-on-a-field/146639/1 "2018-08-30T07:59:51Z")

</div>

Hi, I'm facing an odd situation.

I have a text field (`string_value`) in a index (let's call it `search_index`) which can get the value "OR" (in caps, without quotes).  
I created a Elasticsearch filter section in Logstash to query this index:

```
elasticsearch {
	hosts => ["elasticsearch:9200"]
	index => ["logstash-search_index-*"]
	query => "string_value.keyword:%{[string]}"
	result_size => 1
	fields => {"other_field" => "other_field"}
}

```

What this is basically doing, assuming that `string = OR`, is to query Elasticsearch in this way:

```
GET logstash-search_index-*/_search?q=string_value.keyword:OR

```

However, in this particular case I get an error from Elasticseach:

```
...
"type": "parse_exception",
"reason": "Cannot parse 'string_value.keyword:OR': Encountered \" <OR> \"OR \"\" at line 1, column 24.\nWas expecting one of:\n <BAREOPER> ...\n \"(\" ...\n \"*\" ...\n <QUOTED> ...\n <TERM> ...\n <PREFIXTERM> ...\n <WILDTERM> ...\n <REGEXPTERM> ...\n \"[\" ...\n \"{\" ...\n <NUMBER> ...\n ",
...

```

Other string combinations are working correctly.  
How to avoid this?

Edit: apparently the way to address the issue is to generate the following query:

```
GET logstash-search_index-*/_search?q=string_value.keyword:"OR"

```

But the question is: how to address this on Logstash configuration? Custom query template?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2018, 8:00am UTC](https://discuss.elastic.co/t/query-string-or-on-a-field/146639/2 "2018-09-27T08:00:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.