String query - exact string

[Astarandel]

Hello everyone:

I m doing the following filtering:

beat.hostname:APS01 AND program_name:"deadline"

And I get the results:

Unfortunately, I don't want to include "deadline_balancer" here. When I filter:

"beat.hostname:APS01 AND program_name:"deadline_balancer" it's all good:

Can you please let me know how to accomplish this? The only Info I found in the documentation is:

"To search for an exact string, you need to wrap the string in double quotation marks. Without quotation marks, the search in the example would match any documents containing one of the following words: "Cannot" OR "change" OR "the" OR "info" OR "a" OR "user"."

Thanks in advance!

[monfera (Robert Monfera)]

Hello Astarandel, it's more of an ES question than a Kibana one - is it an analyzed field, and is it using the standard analyzer? If so, is it also a multi-field, eg. also using keyword? Please refer to the links below as to why these matter:

Exact match search on field with "standard" analyzer

You cannot achieve what you require by using the standard analyzer. The standard analyzer is tokenizing the string and creating two tokens: "good" and "one". You can see the results by using the analysis API: curl ' http://localhost:9200/_analyze?text=good@one&analyzer=standard&pretty=true' The field would need to be not_analyzed in order for it to have an exact match, or at the very least, an analyzer that creates only one token (use case dependent). If the field needs to be analyzed fo…

Field data types | Elasticsearch Guide [8.11] | Elastic

[Astarandel]

Thanks a lot Robert!

I m pretty new to the whole ELK stack. I m going to explore your suggestion!

Much appreciated!

[Astarandel]

Hello @monfera,

as far as I understood I need to re-map that certain field to be "not_analyzed". I have a question regarding this. Should I do this in the Elasticsearch or since I use logstash to parse the data, is it needed to create some sort of logstash template?

Thanks a lot for the help!

best,

Lyubo

[monfera (Robert Monfera)]

Hello Lyubo, it's an ES concept, please refer to this thread though it points to a former ES version

[Astarandel]

Thanks for the help. The thread you mentioned is very nice.

Also, I've found out that when I do filtering of the sort:

field_name.keyword:"string_name" does exactly what I want

[monfera (Robert Monfera)]

Yes, the .keyword part is a good route if you still want to preserve the option to run queries on the field as an analyzed field.