# Strict search in Kibana

**URL:** <https://discuss.elastic.co/t/strict-search-in-kibana/256695>\
**Category:** Kibana\
**Created:** [November 25, 2020, 5:42pm UTC](https://discuss.elastic.co/t/strict-search-in-kibana/256695 "2020-11-25T17:42:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![artobstrel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artobstrel/32/16874_2.png) [@artobstrel](https://discuss.elastic.co/u/artobstrel)\
**Post date:** [November 25, 2020, 5:42pm UTC](https://discuss.elastic.co/t/strict-search-in-kibana/256695/1 "2020-11-25T17:42:21Z")

</div>

I'm looking for messages with 'mydomain.tld' homepage address only.

Now i get this result:

 ![kibana_query1](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4fc735c85a6ff8f53ffc66418df47f019f542b79.png)  
where "path" is random uri

How to get below result without photoshop?

 ![kibana_query2](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30a9dbe94243cd64a99b40b9eb796be498c8e8da.png)

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [November 30, 2020, 9:08am UTC](https://discuss.elastic.co/t/strict-search-in-kibana/256695/2 "2020-11-30T09:08:17Z")

</div>

The message field looks like an analyzed field so that is the proper result for your query.  
Solution would be to parse the message field and create a new field that contains just the URL as a keyword field.

---

<div class="post-metadata">

**Author:** ![artobstrel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artobstrel/32/16874_2.png) [@artobstrel](https://discuss.elastic.co/u/artobstrel)\
**Post date:** [November 30, 2020, 10:20am UTC](https://discuss.elastic.co/t/strict-search-in-kibana/256695/3 "2020-11-30T10:20:48Z")

</div>

> [@Marius\_Dragomir](#):
>
> The message field looks like an analyzed field so that is the proper result for your query.  
> Solution would be to parse the message field and create a new field that contains just the URL as a keyword field.

I did so in logstash, but I wanted to know if this could be done only by kibana

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [November 30, 2020, 10:25am UTC](https://discuss.elastic.co/t/strict-search-in-kibana/256695/4 "2020-11-30T10:25:02Z")

</div>

you could do a scripted field that parses the message field, but that's for debugging. For production purposes it will be slow.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2020, 10:25am UTC](https://discuss.elastic.co/t/strict-search-in-kibana/256695/5 "2020-12-28T10:25:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.