# Searching for exact phrase with \[\] in kibana kql
**URL:** https://discuss.elastic.co/t/searching-for-exact-phrase-with-in-kibana-kql/306989
**Category:** Kibana
**Created:** [June 13, 2022, 6:28am UTC](https://discuss.elastic.co/t/searching-for-exact-phrase-with-in-kibana-kql/306989 "2022-06-13T06:28:07Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Alireza\_Zabihi](https://discuss.elastic.co/u/Alireza_Zabihi)
#### Post date: [June 13, 2022, 6:28am UTC](https://discuss.elastic.co/t/searching-for-exact-phrase-with-in-kibana-kql/306989/1 "2022-06-13T06:28:07Z")
Hi, I want to filter messages by exact phrase like [ERROR] in message field, how can I do it ?
I searched with this and many other syntaxes but it returned every error and warn messages.
kubernetes.namespace :"my-namespace" and message : "[ERROR]"
I want just messages with exactly [ERROR] and not Error or error.
Thanks in advance
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [June 13, 2022, 5:42pm UTC](https://discuss.elastic.co/t/searching-for-exact-phrase-with-in-kibana-kql/306989/2 "2022-06-13T17:42:26Z")
Isn't it the problem around field mappings and not only the problem with kql?
match\_phrase query see analyzed texts, in which "[ERROR]", "Error" and "error" may be normalized into a same token: "error". You have to set custom analyzer on that field to distinguish them. One option is a [white space tokenizer](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-whitespace-tokenizer.html) without any token filters.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2022, 5:42pm UTC](https://discuss.elastic.co/t/searching-for-exact-phrase-with-in-kibana-kql/306989/3 "2022-07-11T17:42:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.