# String query - exact string **URL:** \ **Category:** Kibana\ **Created:** [April 15, 2019, 10:47am UTC](https://discuss.elastic.co/t/string-query-exact-string/176883 "2019-04-15T10:47:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Astarandel](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Astarandel](https://discuss.elastic.co/u/Astarandel)\ **Post date:** [April 15, 2019, 10:47am UTC](https://discuss.elastic.co/t/string-query-exact-string/176883/1 "2019-04-15T10:47:36Z")
Hello everyone: I m doing the following filtering: `beat.hostname:APS01 AND program_name:"deadline"` And I get the results: ![ss](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74ebcb8a9ed771da02792da26dc09071d592b269.jpeg) Unfortunately, I don't want to include "deadline\_balancer" here. When I filter: `"beat.hostname:APS01 AND program_name:"deadline_balancer"` it's all good: ![ss2](https://us1.discourse-cdn.com/elastic/original/3X/6/0/60612830a6719bbefe115e2345428bc1e272545d.jpeg) Can you please let me know how to accomplish this? The only Info I found in the documentation is: > "To search for an exact string, you need to wrap the string in double quotation marks. Without quotation marks, the search in the example would match any documents containing one of the following words: "Cannot" OR "change" OR "the" OR "info" OR "a" OR "user"." Thanks in advance! ---
**Author:** ![monfera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monfera/32/26467_2.png) [@monfera](https://discuss.elastic.co/u/monfera)\ **Post date:** [April 15, 2019, 1:29pm UTC](https://discuss.elastic.co/t/string-query-exact-string/176883/2 "2019-04-15T13:29:04Z")
Hello Astarandel, it's more of an ES question than a Kibana one - is it an analyzed field, and is it using the standard analyzer? If so, is it also a multi-field, eg. also using `keyword`? Please refer to the links below as to why these matter: > [@Exact match search on field with "standard" analyzer](https://discuss.elastic.co/t/exact-match-search-on-field-with-standard-analyzer/9617/5): > > You cannot achieve what you require by using the standard analyzer. The standard analyzer is tokenizing the string and creating two tokens: "good" and "one". You can see the results by using the analysis API: curl ' [http://localhost:9200/\_analyze?text=good@one&analyzer=standard&pretty=true](http://localhost:9200/_analyze?text=good@one&analyzer=standard&pretty=true)' The field would need to be not\_analyzed in order for it to have an exact match, or at the very least, an analyzer that creates only one token (use case dependent). If the field needs to be analyzed fo… > **[Field data types | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html#_multi_fields)** ---
**Author:** ![Astarandel](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Astarandel](https://discuss.elastic.co/u/Astarandel)\ **Post date:** [April 15, 2019, 1:44pm UTC](https://discuss.elastic.co/t/string-query-exact-string/176883/3 "2019-04-15T13:44:56Z")
Thanks a lot Robert! I m pretty new to the whole ELK stack. I m going to explore your suggestion! Much appreciated! ---
**Author:** ![Astarandel](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Astarandel](https://discuss.elastic.co/u/Astarandel)\ **Post date:** [April 17, 2019, 10:50am UTC](https://discuss.elastic.co/t/string-query-exact-string/176883/4 "2019-04-17T10:50:21Z")
Hello @monfera, as far as I understood I need to re-map that certain field to be `"not_analyzed"`. I have a question regarding this. Should I do this in the Elasticsearch or since I use logstash to parse the data, is it needed to create some sort of logstash template? Thanks a lot for the help! best, Lyubo ---
**Author:** ![monfera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monfera/32/26467_2.png) [@monfera](https://discuss.elastic.co/u/monfera)\ **Post date:** [April 17, 2019, 11:14am UTC](https://discuss.elastic.co/t/string-query-exact-string/176883/5 "2019-04-17T11:14:24Z")
Hello Lyubo, it's an ES concept, please refer to [this thread](https://discuss.elastic.co/t/logstash-conf-file-with-not-analyzed-field/51902) though it points to a former ES version ---
**Author:** ![Astarandel](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@Astarandel](https://discuss.elastic.co/u/Astarandel)\ **Post date:** [April 17, 2019, 1:29pm UTC](https://discuss.elastic.co/t/string-query-exact-string/176883/6 "2019-04-17T13:29:12Z")
Thanks for the help. The thread you mentioned is very nice. Also, I've found out that when I do filtering of the sort: `field_name.keyword:"string_name"` does exactly what I want 🙂 ---
**Author:** ![monfera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monfera/32/26467_2.png) [@monfera](https://discuss.elastic.co/u/monfera)\ **Post date:** [April 17, 2019, 3:56pm UTC](https://discuss.elastic.co/t/string-query-exact-string/176883/7 "2019-04-17T15:56:42Z")
Yes, the `.keyword` part is a good route if you still want to preserve the option to run queries on the field as an analyzed field. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 15, 2019, 3:56pm UTC](https://discuss.elastic.co/t/string-query-exact-string/176883/8 "2019-05-15T15:56:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.