# Xpack Query Match Not working

**URL:** <https://discuss.elastic.co/t/xpack-query-match-not-working/133212>\
**Category:** Elasticsearch\
**Created:** [May 24, 2018, 7:07pm UTC](https://discuss.elastic.co/t/xpack-query-match-not-working/133212 "2018-05-24T19:07:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![djtecha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djtecha/32/54011_2.png) [@djtecha](https://discuss.elastic.co/u/djtecha)\
**Post date:** [May 24, 2018, 7:07pm UTC](https://discuss.elastic.co/t/xpack-query-match-not-working/133212/1 "2018-05-24T19:07:50Z")

</div>

Hello,  
I'm trying to add a query match for a role in XPACK and it doesn't seem to be working. I believe this is due to the match part getting wrapped in quotes.

```auto
POST _xpack/security/role/kibana_readall
{
    "cluster": [],
    "indices": [
      {
        "names": ["aws*"],
        "privileges": ["read"],
        "query": {
          "term": {"class": "elb"}
        }
      }
    ],
    "transient_metadata": {
      "enabled": true
    }
 }

```

As you can see this should lock this role to the aws index AND documents that have class:elb but when I request the role back to me it's adding quotes:

```auto
GET _xpack/security/role/kibana_readall
 {
  "kibana_readall": {
    "cluster": [],
    "indices": [
      {
        "names": [
          "aws*"
        ],
        "privileges": [
          "read"
        ],
        "query": """{"term":{"class":"elb"}}"""
      }
    ],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
  }
}

```

This leads to a failure in Kibana when the user tries to search this index:

```auto
    Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('\\' (code 92)): was expecting double-quote to start field name\n at [Source: { \\\"match\\\": { \\\"class\\\": \\\"elb\\\"}}; line: 1, column: 4]"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"can_match","grouped":true,"failed_shards":[{"shard":0,"index":"aws-2018.05.18.10-1","node":"VYoBnbxiQECN9XLKQoE46Q","reason":{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('\\' (code 92)): was expecting double-quote to start field name\n at [Source: { \\\"match\\\": { \\\"class\\\": \\\"elb\\\"}}; line: 1, column: 4]","caused_by":{"type":"i_o_exception","reason":"Unexpected character ('\\' (code 92)): was expecting double-quote to start field name\n at [Source: { \\\"match\\\": { \\\"class\\\": \\\"elb\\\"}}; line: 1, column: 4]"}}}]},"status":500}
    at https://kibana.myteksi.net/bundles/commons.bundle.js?v=16627:21:581063
    at Function.Promise.try (https://kibana.myteksi.net/bundles/commons.bundle.js?v=16627:21:479643)
    at https://kibana.myteksi.net/bundles/commons.bundle.js?v=16627:21:479031
    at Array.map (<anonymous>)
    at Function.Promise.map (https://kibana.myteksi.net/bundles/commons.bundle.js?v=16627:21:478989)
    at callResponseHandlers (https://kibana.myteksi.net/bundles/commons.bundle.js?v=16627:21:580641)
    at https://kibana.myteksi.net/bundles/commons.bundle.js?v=16627:21:569987
    at processQueue (https://kibana.myteksi.net/bundles/vendors.bundle.js?v=16627:116:132456)
    at https://kibana.myteksi.net/bundles/vendors.bundle.js?v=16627:116:133349
    at Scope.$digest (https://kibana.myteksi.net/bundles/vendors.bundle.js?v=16627:116:144239)
    at Scope.$apply (https://kibana.myteksi.net/bundles/vendors.bundle.js?v=16627:116:147018)
    at done (https://kibana.myteksi.net/bundles/vendors.bundle.js?v=16627:116:100026)
    at completeRequest (https://kibana.myteksi.net/bundles/vendors.bundle.js?v=16627:116:104697)
    at XMLHttpRequest.xhr.onload (https://kibana.myteksi.net/bundles/vendors.bundle.js?v=16627:116:105435)

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2018, 7:10pm UTC](https://discuss.elastic.co/t/xpack-query-match-not-working/133212/2 "2018-06-21T19:10:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.