# Timelion is rejecting query string that works in dev tools **URL:** https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824 **Category:** Kibana **Tags:** timelion **Created:** [July 16, 2019, 8:39pm UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824 "2019-07-16T20:39:35Z") **Posts on this page:** 8 **Page:** 1
### Author: ![amitavmohanty01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amitavmohanty01/32/58017_2.png) [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01) #### Post date: [July 16, 2019, 8:39pm UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824/1 "2019-07-16T20:39:36Z")
I am able to get search results using the following query string. `GET metricbeat-system-2019.07.16/_search?q=host.name:elklogstash02.mydc+event.dataset:system.network` However, when I use the same in Timelion, it fails. `.es(q=host.name:elklogstash02.mydc+event.dataset:system.network, index=metricbeat-system*)` Timelion uses the [query string format](https://www.elastic.co/blog/timelion-tutorial-from-zero-to-hero). So, I expected that the query string would work. I get the following error in Kibana. `Timelion: Error: in cell #1: [parse_exception] parse_exception: Encountered " ":" ": "" at line 1, column 58. Was expecting one of: ... ... ... "+" ... "-" ... ... "(" ... " *" ... "^" ... ... ... ... ... ... ... "[" ... "{" ... ... (and) [parse_exception] parse_exception: Encountered " ":" ": "" at line 1, column 58. Was expecting one of: ... ... ... "+" ... "-" ... ... "(" ... "* " ... "^" ... ... ... ... ... ... ... "[" ... "{" ... ... (and) [parse_exception] parse_exception: Encountered " ":" ": "" at line 1, column 58. Was expecting one of: ... ... ... "+" ... "-" ... ... "(" ... " *" ... "^" ... ... ... ... ... ... ... "[" ... "{" ... ... (and) [parse_exception] parse_exception: Encountered " ":" ": "" at line 1, column 58. Was expecting one of: ... ... ... "+" ... "-" ... ... "(" ... "* " ... "^" ... ... ... ... ... ... ... "[" ... "{" ... ... (and) [parse_exception] parse_exception: Encountered " ":" ": "" at line 1, column 58. Was expecting one of: ... ... ... "+" ... "-" ... ... "(" ... "*" ... "^" ... ... ... ... ... ... ... "[" ... "{" ... .` Am I missing something? ---
### Author: ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi) #### Post date: [July 16, 2019, 8:53pm UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824/2 "2019-07-16T20:53:46Z")
> [@amitavmohanty01](#): > > parse\_exception: Encountered " ":" ": "" at line 1, column 58. Was expecting one of: I guess your query string is missing something. The documentation provides a list of reserved characters, which includes `/` I think between copy/pasting in this thread a bunch of the single quotes have been replaced with double-quotes and smart-quotes. When you're trying it I think you should be using single quotes everywhere. Let me know if that fixes it. Another thought is to break down you expression so that you can test each part. For example, the `.es()` block inside the `index=metricbeat-system*` does that work by itself? .[Query string query | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_regular_expressions) ---
### Author: ![amitavmohanty01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amitavmohanty01/32/58017_2.png) [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01) #### Post date: [July 16, 2019, 8:57pm UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824/3 "2019-07-16T20:57:35Z")
> [@rashmi](#): > > Another thought is to break down you expression so that you can test each part. For example, the `.es()` block inside the `index=metricbeat-system*` does that work by itself? Yes, `.es(index=metricbeat-system*)` works fine. ---
### Author: ![amitavmohanty01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amitavmohanty01/32/58017_2.png) [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01) #### Post date: [July 16, 2019, 9:01pm UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824/4 "2019-07-16T21:01:37Z")
`.es(q='host.name:elklogstash02.mydc', index=metricbeat-system*)` does not work. However, `.es(q=host.name:elklogstash02.mydc, index=metricbeat-system*)` works fine. So, the question that remains to be answered is how do I include the `+` in the Timelion query so that the second clause is also added. ---
### Author: ![amitavmohanty01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amitavmohanty01/32/58017_2.png) [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01) #### Post date: [July 16, 2019, 9:09pm UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824/5 "2019-07-16T21:09:41Z")
The error message is seen in the attachment. ![37%20AM](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0adc9926784a655925a231456268738beea819d7.png) ---
### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr) #### Post date: [July 16, 2019, 9:50pm UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824/6 "2019-07-16T21:50:51Z")
Could you try it with these single and double quotes in your query? .es(q='host.name:"elklogstash02.mydc+event.dataset:system.network"', index=metricbeat-system\*) there's single quotes around the whole query string; q=' ' and there's double quotes around the actual search value "elklogstash02.mydc+event.dataset:system.network" ---
### Author: ![amitavmohanty01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amitavmohanty01/32/58017_2.png) [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01) #### Post date: [July 17, 2019, 7:18am UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824/7 "2019-07-17T07:18:02Z")
`.es(q='host.name:"elklogstash02.mydc"+event.dataset:"system.network"', index=metricbeat-system*)` worked. Thanks @LeeDr ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [August 14, 2019, 7:18am UTC](https://discuss.elastic.co/t/timelion-is-rejecting-query-string-that-works-in-dev-tools/190824/8 "2019-08-14T07:18:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.