# Substring search in Kibana 4 search bar **URL:** \ **Category:** Kibana\ **Created:** [October 27, 2015, 8:47pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109 "2015-10-27T20:47:48Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![yolife](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yolife/32/5569_2.png) [@yolife](https://discuss.elastic.co/u/yolife)\ **Post date:** [October 27, 2015, 8:47pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/1 "2015-10-27T20:47:48Z")
Hi, I am trying to search substring in specific field using search bar, tried using wild card search but it doesn't work. Example, I want to find out all documents where errorcode field in document contains "ERROR" word. errorcode field contains "Display ERROR", "Search ERROR", "Null ERROR" etc. Please help here. OR refer to screenshot below. I only want to search testplan: which contain word "3D". The field testplan is not analyzed. ![](https://us1.discourse-cdn.com/elastic/original/2X/1/1df15bd0761ee9214c547a2f0d98887e98bf89bd.png) ---
**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Post date:** [October 29, 2015, 6:18am UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/2 "2015-10-29T06:18:19Z")
So what search were you trying in the screenshot above? Are you trying to get only records that have the exact value "3D" or anything that includes "3D" as a substring? ---
**Author:** ![yolife](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yolife/32/5569_2.png) [@yolife](https://discuss.elastic.co/u/yolife)\ **Post date:** [October 29, 2015, 12:20pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/3 "2015-10-29T12:20:54Z")
I tried following searches in searchbar -- 1. testplan:"3D" 2. testplan:"_3D_" 3. testplan:_3D_ 4. testplan: "3D~20" 5. 3D -- this one searches in all fields -- which I don't want. I want to find all records where testplan field contains "3D" word. I am trying to get records where testplan field contains value "3D" as substring. Only testplan field. ---
**Author:** ![yolife](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yolife/32/5569_2.png) [@yolife](https://discuss.elastic.co/u/yolife)\ **Post date:** [October 29, 2015, 4:19pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/4 "2015-10-29T16:19:35Z")
This Query worked in Kibana 4.2 Toolbar. Is there any other easier way to do it. { "wildcard" : { "testplan" : "_3D_" } } Thank you, Yogesh. ---
**Author:** ![yolife](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yolife/32/5569_2.png) [@yolife](https://discuss.elastic.co/u/yolife)\ **Post date:** [November 5, 2015, 8:14pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/5 "2015-11-05T20:14:30Z")
Guys, anyone knows any easier way to do this? it will be great help... Thanks in advance. ---
**Author:** ![PSi\_AU](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psi_au/32/5617_2.png) [@PSi\_AU](https://discuss.elastic.co/u/PSi_AU)\ **Post date:** [November 5, 2015, 10:35pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/6 "2015-11-05T22:35:35Z")
Try 3D\* without the double quotes. Also try asterix3Dasterix again without the double quotes. Replace the asterix with \*, for some reason the forums are mangling my response. ---
**Author:** ![yolife](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yolife/32/5569_2.png) [@yolife](https://discuss.elastic.co/u/yolife)\ **Post date:** [November 6, 2015, 12:49pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/7 "2015-11-06T12:49:10Z")
I only want to search in one field 'testplan' and not all fields. The solution provided will work for all fields. ---
**Author:** ![PSi\_AU](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psi_au/32/5617_2.png) [@PSi\_AU](https://discuss.elastic.co/u/PSi_AU)\ **Post date:** [November 6, 2015, 1:03pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/8 "2015-11-06T13:03:20Z")
Then do testplan:asterix3Dasterix Again replace asterix with \* Don't enclose the whole lot in double quotes. ---
**Author:** ![yolife](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yolife/32/5569_2.png) [@yolife](https://discuss.elastic.co/u/yolife)\ **Post date:** [November 9, 2015, 11:03am UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/9 "2015-11-09T11:03:55Z")
@PSi_AU -- No this doesn't work. ![](https://us1.discourse-cdn.com/elastic/original/2X/4/4571d65906e878dc7533e412144740a8a994ced4.png) and when I search with asterix3Dasterix (replace asterix with \*) then I get testplans with 3D as well as not containing 3D ![](https://us1.discourse-cdn.com/elastic/original/2X/0/0f0c8d502d7ceb1f39a2d27812a1ab1af6afad2f.png) ---
**Author:** ![Rajeev\_Gaurav](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\ **Post date:** [April 13, 2016, 1:09pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/10 "2016-04-13T13:09:58Z")
Any update on this. Any help regarding substring search in Kibana 4 search bar. ---
**Author:** ![jazzed](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@jazzed](https://discuss.elastic.co/u/jazzed)\ **Post date:** [September 12, 2016, 10:33pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/11 "2016-09-12T22:33:59Z")
Substring search is just put in double quotes. To search a specific field, use the field name and double quotes. message: "blah1 blah2" ---
**Author:** ![A\_User](https://avatars.discourse-cdn.com/v4/letter/a/a8b319/32.png) [@A\_User](https://discuss.elastic.co/u/A_User)\ **Post date:** [May 11, 2017, 11:56am UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/12 "2017-05-11T11:56:54Z")
nothing of the mentioned solutions work for me. I have a field called branchCode and i try to search for any values containing either master or single, like "origin/master" or "dev/singleObject". I either get a full string matching or nothing. How do i something like this: branchCode: \*master OR branchCode: _single_ The docs are far away from being helpfull (in most cases sadly). Using kibana 5.3.2 and a solution for this problem would be very appreciated! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:31pm UTC](https://discuss.elastic.co/t/substring-search-in-kibana-4-search-bar/33109/13 "2017-07-06T13:31:59Z")