Unexpected Behavior of Kibana Query for Filtering Logs with Specific Keywords

[Dokh_Ahmed (Add123454321)]

I'm using a Kibana query (log_message:(Started* OR Disabled*)) to filter logs that start with the keywords "Started" or "Disabled". However, I've noticed that this query also returns log lines containing these keywords in the middle of the line, not just at the beginning. I expected only lines starting with these keywords to be returned.

Is there an error in my query or a specific way to filter only log lines that start with these keywords rather than lines containing these words elsewhere in the log?

Thank you for your help!

[Priscilla_Parodi]

Hello @Dokh_Ahmed,

This is a text field, correct? Try using the keyword sub-field instead.

log_message.keyword: (Started* OR Disabled*)

Then you will have an exact match.