# Search for a substring within a specific field

**URL:** <https://discuss.elastic.co/t/search-for-a-substring-within-a-specific-field/118841>\
**Category:** Kibana\
**Created:** [February 7, 2018, 12:25pm UTC](https://discuss.elastic.co/t/search-for-a-substring-within-a-specific-field/118841 "2018-02-07T12:25:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ghouston10](https://avatars.discourse-cdn.com/v4/letter/g/ec9cab/32.png) [@ghouston10](https://discuss.elastic.co/u/ghouston10)\
**Post date:** [February 7, 2018, 12:25pm UTC](https://discuss.elastic.co/t/search-for-a-substring-within-a-specific-field/118841/1 "2018-02-07T12:25:56Z")

</div>

Hi,

Is it possible in kibana to search for a substring contained within a specific field?

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 7, 2018, 7:33pm UTC](https://discuss.elastic.co/t/search-for-a-substring-within-a-specific-field/118841/2 "2018-02-07T19:33:42Z")

</div>

hi @ghouston10,

I think the answer is, it depends.

1. In any place you would be using Painless, for example, in Kibana's scripted fields, you can use Regex to do substring matches on a field-value.

See here for an example: [Substring in painless](https://discuss.elastic.co/t/substring-in-painless/88660/3)

1. You can also do prefix-queries with lucene using the wildcard character. So in the Kibana query-bar, you could do something like `url:https*` to search for all https calls. The wildcard query in lucene cannot be put at the start of a string. More info on that here: [https://lucene.apache.org/core/2\_9\_4/queryparsersyntax.html#Terms](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html#Terms)

---

<div class="post-metadata">

**Author:** ![ghouston10](https://avatars.discourse-cdn.com/v4/letter/g/ec9cab/32.png) [@ghouston10](https://discuss.elastic.co/u/ghouston10)\
**Post date:** [February 8, 2018, 8:53am UTC](https://discuss.elastic.co/t/search-for-a-substring-within-a-specific-field/118841/3 "2018-02-08T08:53:47Z")

</div>

Hi,

Thanks for the reply. I would be performing the search using dev tools within Kibana. How would it be implemented there?

Thanks

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [February 8, 2018, 1:58pm UTC](https://discuss.elastic.co/t/search-for-a-substring-within-a-specific-field/118841/4 "2018-02-08T13:58:43Z")

</div>

In the console, you would just put raw ES-queries. You probably want to look at the regexp searching:

[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html)

Note that this only works on keyword fields, not on analyzed fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2018, 1:59pm UTC](https://discuss.elastic.co/t/search-for-a-substring-within-a-specific-field/118841/5 "2018-03-08T13:59:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.