# Unexpected Behavior of Kibana Query for Filtering Logs with Specific Keywords

**URL:** <https://discuss.elastic.co/t/unexpected-behavior-of-kibana-query-for-filtering-logs-with-specific-keywords/348055>\
**Category:** Kibana\
**Created:** [November 27, 2023, 1:34pm UTC](https://discuss.elastic.co/t/unexpected-behavior-of-kibana-query-for-filtering-logs-with-specific-keywords/348055 "2023-11-27T13:34:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dokh\_Ahmed](https://avatars.discourse-cdn.com/v4/letter/d/91b2a8/32.png) [@Dokh\_Ahmed](https://discuss.elastic.co/u/Dokh_Ahmed)\
**Post date:** [November 27, 2023, 1:34pm UTC](https://discuss.elastic.co/t/unexpected-behavior-of-kibana-query-for-filtering-logs-with-specific-keywords/348055/1 "2023-11-27T13:34:14Z")

</div>

I'm using a Kibana query (log\_message:(Started\* OR Disabled\*)) to filter logs that start with the keywords "Started" or "Disabled". However, I've noticed that this query also returns log lines containing these keywords in the middle of the line, not just at the beginning. I expected only lines starting with these keywords to be returned.

 ![Capture d’écran 2023-11-27 143333](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a218c301d89dcbad7ac1b84aacf0b058765210f5.jpeg)

Is there an error in my query or a specific way to filter only log lines that start with these keywords rather than lines containing these words elsewhere in the log?

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![Priscilla\_Parodi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priscilla_parodi/32/43047_2.png) [@Priscilla\_Parodi](https://discuss.elastic.co/u/Priscilla_Parodi)\
**Post date:** [November 30, 2023, 2:04pm UTC](https://discuss.elastic.co/t/unexpected-behavior-of-kibana-query-for-filtering-logs-with-specific-keywords/348055/2 "2023-11-30T14:04:30Z")

</div>

Hello @Dokh_Ahmed,

This is a text field, correct? Try using the keyword sub-field instead.

`log_message.keyword: (Started* OR Disabled*)`

Then you will have an exact match.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2023, 2:04pm UTC](https://discuss.elastic.co/t/unexpected-behavior-of-kibana-query-for-filtering-logs-with-specific-keywords/348055/3 "2023-12-28T14:04:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.