# SQL WHERE clause usage

**URL:** https://discuss.elastic.co/t/sql-where-clause-usage/170709
**Category:** Elasticsearch
**Tags:** elastic-stack-sql
**Created:** [March 4, 2019, 10:50am UTC](https://discuss.elastic.co/t/sql-where-clause-usage/170709 "2019-03-04T10:50:58Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Pradyumna\_Achar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pradyumna_achar/32/99780_2.png) [@Pradyumna\_Achar](https://discuss.elastic.co/u/Pradyumna_Achar)
#### Post date: [March 4, 2019, 10:50am UTC](https://discuss.elastic.co/t/sql-where-clause-usage/170709/1 "2019-03-04T10:50:58Z")

</div>

Hello,  
I am trying to understand basic usage of the WHERE clause in Elasicsearch SQL queries.  
I loaded the shakespeare dataset from [https://www.elastic.co/guide/en/kibana/current/tutorial-load-dataset.html](https://www.elastic.co/guide/en/kibana/current/tutorial-load-dataset.html)

While I am able to use the WHERE clause on integer fields, I can't do the same with keyword fields, as shown below. What is the right usage of the WHERE clause for keyword fields?

Thank you.

```
root@bef0601e3d30:/#
root@bef0601e3d30:/# curl -d '{"query":"select * from shakespeare where speech_number=2 limit 5"}' -X POST -H 'Content-Type: application/json' elastic:9200/_xpack/sql?format=txt
    line_id | line_number | play_name | speaker | speech_number | text_entry | type
---------------+---------------+---------------+---------------+---------------+---------------------------------------------+---------------
38 |1.1.35 |Henry IV |WESTMORELAND |2 |And many limits of the charge set down |line
40 |1.1.37 |Henry IV |WESTMORELAND |2 |A post from Wales loaden with heavy news; |line
46 |1.1.43 |Henry IV |WESTMORELAND |2 |Upon whose dead corpse there was such misuse,|line
37 |1.1.34 |Henry IV |WESTMORELAND |2 |My liege, this haste was hot in question, |line
47 |1.1.44 |Henry IV |WESTMORELAND |2 |Such beastly shameless transformation, |line
root@bef0601e3d30:/# curl -d '{"query":"select * from shakespeare where speaker='WESTMORELAND' limit 5"}' -X POST -H 'Content-Type: application/json' elastic:9200/_xpack/sql?format=txt
{"error":{"root_cause":[{"type":"verification_exception","reason":"Found 1 problem(s)\nline 1:41: Unknown column [WESTMORELAND]"}],"type":"verification_exception","reason":"Found 1 problem(s)\nline 1:41: Unknown column [WESTMORELAND]"},"status":400}root@bef0601e3d30:/#
root@bef0601e3d30:/#
```

---

<div class="post-metadata">

### Author: ![Andrei\_Stefan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrei_stefan/32/47533_2.png) [@Andrei\_Stefan](https://discuss.elastic.co/u/Andrei_Stefan)
#### Post date: [March 5, 2019, 1:08pm UTC](https://discuss.elastic.co/t/sql-where-clause-usage/170709/2 "2019-03-05T13:08:33Z")

</div>

@Pradyumna_Achar I think you need to escape the single quotes surrounding the `WESTMORELAND` word, since your `curl` using the single quotes for the json block.

Or, alternatively, you can use curl with double quotes and escape all the double quotes inside your json: `curl -d "{\"query\":\"select * from shakespeare where speaker='WESTMORELAND' limit 5\"}" -X POST -H 'Content-Type: application/json' elastic:9200/_xpack/sql?format=txt'`

---

<div class="post-metadata">

### Author: ![Pradyumna\_Achar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pradyumna_achar/32/99780_2.png) [@Pradyumna\_Achar](https://discuss.elastic.co/u/Pradyumna_Achar)
#### Post date: [March 6, 2019, 5:05am UTC](https://discuss.elastic.co/t/sql-where-clause-usage/170709/3 "2019-03-06T05:05:57Z")

</div>

Thank you, that worked.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 3, 2019, 5:05am UTC](https://discuss.elastic.co/t/sql-where-clause-usage/170709/4 "2019-04-03T05:05:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
