Querying for exact match in Kibana

Question

In my Kibana, when I search my document I need to look for exact match: In my document I have a field named message.

So If I search (Using Kibana) something like:

message: "Provider replied with error code 2006"

I get all the documents that have one instance of those words. I would like to have exact match.

I am running Kibana: 5.3.2. and Elasticsearch is 5.3.2

Answer 1

In Elasticsearch are two Types of "Strings".

• Keyword:

  They are typically used for filtering (Find me all blog posts where status is published), for sorting, and for aggregations. Keyword
  fields are only searchable by their exact value.

  See the docs

• Text

  field to index full-text values, such as the body of an email or the description of a product. These fields are analyzed, that is they are passed through an analyzer to convert the string into a list of individual terms before being indexed.

  See the docs

Sometimes it is possible to access to the Keyword by adding ".keyword" to your field. So try this one:

message.keyword: "Provider replied with error code 2006"

Otherwise you have to check your mapping and change it to Keyword.