# Timelion query

**URL:** <https://discuss.elastic.co/t/timelion-query/107050>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [November 9, 2017, 1:53pm UTC](https://discuss.elastic.co/t/timelion-query/107050 "2017-11-09T13:53:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![adachi](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@adachi](https://discuss.elastic.co/u/adachi)\
**Post date:** [November 9, 2017, 1:53pm UTC](https://discuss.elastic.co/t/timelion-query/107050/1 "2017-11-09T13:53:34Z")

</div>

Hi!  
I'm trying to get query working in Timelion with no success.  
The query: `.es(index=testindex_tag-*, metric='max:cooldata', q='tags:server_type-test-x2')`  
The problem is Timelion gets me data containing not only the exact tag `server_type-test-x2` but also gets me anytag that contains `server` `type` `test` `x2`  
In my case i have tag `server_type-test-x2` and `server_type-test-x5`,the query above gets me data from both tags.  
It seems that it treats `-` and `_` as wildcard of some sort.  
How can I get data with exact tag?

---

<div class="post-metadata">

**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\
**Post date:** [November 10, 2017, 1:45pm UTC](https://discuss.elastic.co/t/timelion-query/107050/2 "2017-11-10T13:45:17Z")

</div>

Try using either quotes, or if you have a non-analyzed field with the same data, you can point to that. Elasticsearch might have created one for you automatically depending on how you set up your mappings, and what version you are using - you can check this out in the Index patterns page of management:

 ![28 AM](https://us1.discourse-cdn.com/elastic/original/3X/e/f/eff10ed9d02d2fb27b9de533401ce5b42990fb9e.png)

the `.keyword` one above is the one that won't strip out special characters. So here are a few examples:

The query as you wrote it, returns too many matches:

 ![19 AM](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c13e5a31e11e36e4e7b8065bc6624e27207db352.png)

Adding quotes removes them:

 ![28 AM](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d7d19ad7446d4eb06051655914665cafcd26ef1a.png)

As does using the `.keyword` variation:

 ![37 AM](https://us1.discourse-cdn.com/elastic/original/3X/8/1/815bc63e5d1c669ff5a1e33afbcd525586daecb2.png)

Here is my data for reference in this example:  
 ![29 AM](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b7cbaa3c63c3decef65cb7016471a733a4a199bd.png)

Hope that helps!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2017, 1:45pm UTC](https://discuss.elastic.co/t/timelion-query/107050/3 "2017-12-08T13:45:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.