# Simple search question

**URL:** <https://discuss.elastic.co/t/simple-search-question/91136>\
**Category:** Kibana\
**Created:** [June 28, 2017, 3:13pm UTC](https://discuss.elastic.co/t/simple-search-question/91136 "2017-06-28T15:13:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frrrrrunkis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frrrrrunkis/32/42750_2.png) [@Frrrrrunkis](https://discuss.elastic.co/u/Frrrrrunkis)\
**Post date:** [June 28, 2017, 3:13pm UTC](https://discuss.elastic.co/t/simple-search-question/91136/1 "2017-06-28T15:13:43Z")

</div>

New user looking to learn query syntax

looking to search on [ERROR] but whatever I tried returns Error as well.

Some of the things i tried I though would work.  
message: [ERROR]  
message: "[ERROR]"  
message: "[ERROR]"

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [June 28, 2017, 8:31pm UTC](https://discuss.elastic.co/t/simple-search-question/91136/2 "2017-06-28T20:31:22Z")

</div>

HI

If you would like to know more about query syntax, I would recommend this blog. It does give a good explanation of it...

> **[Elasticsearch/Kibana Queries - In Depth Tutorial](https://www.timroes.de/2016/05/29/elasticsearch-kibana-queries-in-depth-tutorial/)**
>
> This tutorial explains how to write and understand Kibana and Elasticsearch queries
> in depth and how the mapping of Elastichsearch influences these queries.

and about your question:

it's probably because of the analyzer used on their message field, which is setup in the mappings by default a text field will use the standard analyzer, which will lower case everything so if the word "ERROR" or "Error" appear in their message, both will get normalized to "error" same for the query string itself, even though they're searching for "ERROR", it get's normalized to "error"

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 26, 2017, 8:31pm UTC](https://discuss.elastic.co/t/simple-search-question/91136/3 "2017-07-26T20:31:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.