# Search for string starting with S-1-5-21

**URL:** <https://discuss.elastic.co/t/search-for-string-starting-with-s-1-5-21/215924>\
**Category:** Elasticsearch\
**Created:** [January 21, 2020, 5:01pm UTC](https://discuss.elastic.co/t/search-for-string-starting-with-s-1-5-21/215924 "2020-01-21T17:01:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [January 21, 2020, 5:01pm UTC](https://discuss.elastic.co/t/search-for-string-starting-with-s-1-5-21/215924/1 "2020-01-21T17:01:10Z")

</div>

I am storing users SID and ACLs in elastic but when I try to search for group Users (SID: S-1-5-31-\*) it returns all users that contain S or 1 or 5.

If used SID.keyword you have you put the exact match SID you cant sepecify SID.keyword:S-1-5-31-\*

How can I do a search of users that starts with an specific SID string? and not threat - like OR ?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 22, 2020, 2:27pm UTC](https://discuss.elastic.co/t/search-for-string-starting-with-s-1-5-21/215924/2 "2020-01-22T14:27:49Z")

</div>

Hey,

you can search in the keyword field using a [prefix query](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/query-dsl-prefix-query.html). Or using the query string, like this

```auto
PUT foo/_doc/1
{
  "foo" : "S-1-5-31 whatever here"
}

GET foo/_search
{
  "query": {
    "query_string": {
      "default_field": "any_field",
      "query": "foo.keyword:S-1-5*"
    }
  }
}

```

the last one returns the document as expected. Is there a difference to your query that I am missing?

---

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [January 23, 2020, 1:54pm UTC](https://discuss.elastic.co/t/search-for-string-starting-with-s-1-5-21/215924/3 "2020-01-23T13:54:46Z")

</div>

If i search in kibana searchbar foo.keyword:S-1-5\* it doesnt work

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2020, 1:54pm UTC](https://discuss.elastic.co/t/search-for-string-starting-with-s-1-5-21/215924/4 "2020-02-20T13:54:47Z")

</div>

Closed on February 20, 2020, 1:54pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.