# Query filters are not applied
**URL:** https://forum.opensearch.org/t/query-filters-are-not-applied/27377
**Category:** OpenSearch
**Created:** [October 27, 2025, 8:34pm UTC](https://forum.opensearch.org/t/query-filters-are-not-applied/27377 "2025-10-27T20:34:49Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@dennis\_u](https://forum.opensearch.org/u/dennis_u)
#### Post date: [October 27, 2025, 8:34pm UTC](https://forum.opensearch.org/t/query-filters-are-not-applied/27377/1 "2025-10-27T20:34:49Z")
**Versions** : OS 3.2.0
**Describe the issue** : I want to use a python script to send multiple queries to OS. However, I get always the most recent log entry. The filter of the query is not applied.
My query is like this:
```json
GET /syslog-*/_search
{
"query": {
"query_string": {
"query": "syslog_program:suricata and fw_name: sws01. *********** and suricata.alert.signature:* and suricata.src_ip:* and suricata.dest_ip:10.10.* and not suricata.src_ip:10.10.*"
}
},
"size": 2,
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
```
I want to filter to syslog\_program: suricata, but I get all syslog\_program values. In case of the screenshot, it is “charon”. The usage of match is not possible, since I have several query strings I iterate. I do not get syntaxt errors, I guess it is more a logical error, but I do not get it.
**Configuration** : nothing relevant
**Relevant Logs or Screenshots** :
---
### Author:  [@Anthony](https://forum.opensearch.org/u/Anthony)
#### Post date: [October 28, 2025, 10:38am UTC](https://forum.opensearch.org/t/query-filters-are-not-applied/27377/2 "2025-10-28T10:38:35Z")
@dennis_u can you provide the mappings of this index? Is the query being applied to a text field or keyword?
If you have the following mappings:
```auto
PUT syslog-demo
{
"mappings": {
"properties": {
"@timestamp": { "type": "date" },
"syslog_program": { "type": "keyword" },
"fw_name": { "type": "keyword" },
"suricata": {
"properties": {
"alert": {
"properties": {
"signature": { "type": "keyword" }
}
},
"src_ip": { "type": "ip" },
"dest_ip": { "type": "ip" }
}
}
}
}
}
```
You can use this query:
```auto
GET syslog-demo/_search
{
"size": 10,
"sort": [{ "@timestamp": "desc" }],
"query": {
"query_string": {
"query": "syslog_program:\"suricata\" AND fw_name:\"sws01.example\" AND _exists_:suricata.alert.signature AND _exists_:suricata.src_ip AND suricata.dest_ip:\"10.10.0.0/16\" AND NOT suricata.src_ip:\"10.10.0.0/16\""
}
}
}
```
---
### Author:  [@dennis\_u](https://forum.opensearch.org/u/dennis_u)
#### Post date: [October 29, 2025, 8:03am UTC](https://forum.opensearch.org/t/query-filters-are-not-applied/27377/3 "2025-10-29T08:03:13Z")
Thx for your reply.
I thought the value assignment in logstash does this. But I read, this is independent.
I wanted to change the value in the index pattern, but is not possible:
Do I have to change it in the indexes? I create everyday a new one.
I am wondering that I can use OSD for searching, but not direct on OS level.
(P.S.: suricata creates several dest\_ip fields. I am aware of it that I used suricata.alert.dest\_ip in the opener)
_ **Edit:** _ Ah, the way to go is to create an ‘index template’ for (in my case) syslog-\* and to put the mappings in there. Every new index has the new mappings, right?
---
### Author:  [@Anthony](https://forum.opensearch.org/u/Anthony)
#### Post date: [October 29, 2025, 9:57am UTC](https://forum.opensearch.org/t/query-filters-are-not-applied/27377/4 "2025-10-29T09:57:47Z")
@dennis_u yes, index template is the way to go if you want to ensure the mapping is consistent.
---
### Author:  [@mkhl](https://forum.opensearch.org/u/mkhl)
#### Post date: [November 4, 2025, 6:28pm UTC](https://forum.opensearch.org/t/query-filters-are-not-applied/27377/5 "2025-11-04T18:28:26Z")
I guess space after `fw_name:` might cause a problem. /\_validate/query?explain=true [Validate query - OpenSearch Documentation](https://docs.opensearch.org/latest/api-reference/search-apis/validate) might give clue what’s going on here.