# Rationale for indexing url as keyword?

**URL:** <https://discuss.elastic.co/t/rationale-for-indexing-url-as-keyword/169560>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 22, 2019, 10:53am UTC](https://discuss.elastic.co/t/rationale-for-indexing-url-as-keyword/169560 "2019-02-22T10:53:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tback](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tback/32/41236_2.png) [@tback](https://discuss.elastic.co/u/tback)\
**Post date:** [February 22, 2019, 10:53am UTC](https://discuss.elastic.co/t/rationale-for-indexing-url-as-keyword/169560/1 "2019-02-22T10:53:42Z")

</div>

I'm curious about the rationale for indexing urls as keyword by default (in my case it's nginx.access.url, but I noticed it's the same for apache and others) .  
The documentation states that Keyword fields are searchable by their exact value only. Now, I think it's pretty common to search logs for parts of urls: Show me timings for all images, show me timings for all images of a specific customer, etc.  
This way the url field is barely usable by default.

What am I missing here?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [February 22, 2019, 5:40pm UTC](https://discuss.elastic.co/t/rationale-for-indexing-url-as-keyword/169560/2 "2019-02-22T17:40:28Z")

</div>

You can use a wide range of queries on a `keyword`, for example `prefix`, `wildcard`, `regex` and `fuzzy`. See [Term level queries](https://www.elastic.co/guide/en/elasticsearch/reference/current/term-level-queries.html).

I guess it would be more correct to state that _"keyword fields are indexed by their exact value"_, unlike `text` fields, which are passed through an [analyzer](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis.html) to convert the string into a list of terms that are indexed individually.

---

<div class="post-metadata">

**Author:** ![tback](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tback/32/41236_2.png) [@tback](https://discuss.elastic.co/u/tback)\
**Post date:** [February 25, 2019, 8:52am UTC](https://discuss.elastic.co/t/rationale-for-indexing-url-as-keyword/169560/3 "2019-02-25T08:52:03Z")

</div>

Thanks Adrian,

this makes much more sense to me now. The term "[Keyword fields are only searchable by their exact value](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html#keyword)" was what confused me.

Btw: Does Kibana support term level queries natively (maybe with kuery) or do I have to resort to raw queries through "edit query dsl"?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2019, 8:52am UTC](https://discuss.elastic.co/t/rationale-for-indexing-url-as-keyword/169560/4 "2019-03-25T08:52:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.