# Search for specific symbols

**URL:** <https://discuss.elastic.co/t/search-for-specific-symbols/97381>\
**Category:** Kibana\
**Created:** [August 17, 2017, 9:47am UTC](https://discuss.elastic.co/t/search-for-specific-symbols/97381 "2017-08-17T09:47:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hsatgol](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@hsatgol](https://discuss.elastic.co/u/hsatgol)\
**Post date:** [August 17, 2017, 9:47am UTC](https://discuss.elastic.co/t/search-for-specific-symbols/97381/1 "2017-08-17T09:47:46Z")

</div>

I'm using ELK on AWS. I want to analyze AWS ELB (load balancer) logs, and later on, I would love to see here Nginx logs as well.

I've setup everything and it works! So, thanks for your software guys!

Meanwhile, I have a small issue.

I've configured insertion logs into search cluster, then I went to Kibana UI and choose the default index (which is: elblogs-\*, in my case).

Then I executed a mapping update to treat some fields in a way which will allow me to search for specific symbols (like: -, /, \ etc).

Here is the query:  
`curl -XPUT 'https://awses-domain/elblogs*/_mapping/elb-access-logs' --data "@update_mapper_for_raw.json"`

Here is the content of the file:

```
{
	"properties": {
		"request_uri_path": {
			"type": "text",
			"fields": {
				"raw": {
					"type": "keyword",
					"index": "not_analyzed"
				}
			}
		}
	}
}

```

Then I've double checked the mapping  
`curl -XGET 'https://awses-domain/elblogs*/_mapping`

and I can see my changes here

```
{
  "elblogs-2017.08.17": {
    "aliases": {},
    "mappings": {
      "elb-access-logs": {
        "properties": {
          ...
         	"request_uri_path": {
	        "type": "text",
	        "fields": {
        	  "keyword": {
	    	     "type": "keyword",
		          "ignore_above": 256
 		      },
              "raw": {
     	     	"type": "keyword"
	          }
     	    }
          },
          ...
        }
      }
    },
    "settings": {
      "index": {
        "creation_date": "1502960475384",
        "number_of_shards": "5",
        "number_of_replicas": "1",
        "uuid": "TcdTaIooTwqnXBkFDV_qMg",
        "version": {
          "created": "5030299"
        },
        "provided_name": "elblogs-2017.08.17"
      }
    }
  }
}

```

Even though in Kibana I can see it is as searchable

![41](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75d98cc284f4304b67ec2ad88a4989f19595fead.png)

I can see no result on any type of the search against this field, I can't see this field either in any other search result. How can I fix it?

---

<div class="post-metadata">

**Author:** ![BigFunger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigfunger/32/7323_2.png) [@BigFunger](https://discuss.elastic.co/u/BigFunger)\
**Post date:** [August 17, 2017, 3:38pm UTC](https://discuss.elastic.co/t/search-for-specific-symbols/97381/2 "2017-08-17T15:38:44Z")

</div>

Two questions.

1. Did you click on the refresh button in your index pattern?  

2. Did you index new documents after you updated your mapping? Updating your mapping will not modify any of the documents that have already been indexed.

---

<div class="post-metadata">

**Author:** ![hsatgol](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@hsatgol](https://discuss.elastic.co/u/hsatgol)\
**Post date:** [August 17, 2017, 5:22pm UTC](https://discuss.elastic.co/t/search-for-specific-symbols/97381/3 "2017-08-17T17:22:25Z")

</div>

Thanks for your questions and yes my answer is "Yes" for both of them.

Regarding the search I think I start getting any of the results but I'm confused about `-` symbol and slash `\`

Because now if I insert into the search field (Kubana UI) following text

`request_ur_path.raw=mysearchword\-*`

Kibana shows me results like

- mysearchword-newthing
- newthing-mysearchword/bla/bla
- and even this `blabla-mysearchword`

then how I can specify that I want to find a word + dash + any other word but not the end of the string, not slash etc.. kinda regex?

Thanks

---

<div class="post-metadata">

**Author:** ![BigFunger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigfunger/32/7323_2.png) [@BigFunger](https://discuss.elastic.co/u/BigFunger)\
**Post date:** [August 17, 2017, 8:38pm UTC](https://discuss.elastic.co/t/search-for-specific-symbols/97381/4 "2017-08-17T20:38:40Z")

</div>

Yes, it is acting as a regular expression (although elasticsearch/kibana use a [specific flavor of regex](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html))

---

<div class="post-metadata">

**Author:** ![hsatgol](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@hsatgol](https://discuss.elastic.co/u/hsatgol)\
**Post date:** [August 18, 2017, 5:12am UTC](https://discuss.elastic.co/t/search-for-specific-symbols/97381/5 "2017-08-18T05:12:24Z")

</div>

Oh, Ok I see what is wrong, it is the wrong syntax, the right one is

`request_uri_path.raw:mysearchkeyword` I mean `field_name:search_value` and before I've used `=` and not `:`

The only bad thing that there is no highlighted result in case search against `.raw` field

Is it possible to change somehow?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2017, 5:12am UTC](https://discuss.elastic.co/t/search-for-specific-symbols/97381/6 "2017-09-15T05:12:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.