Template variable not quoted in ES query when it is used to repeat a panel and only one value is selected

Hi. I’m building a panel that is repeated over a template variable whose values can contain spaces. When I include this variable in the panel’s query, the selected value is plugged into the query without surrounding quotes causing inaccurate results…

I was able to observe this behaviour (of the way the query is built, if not the results) in the “Elasticsearch Templated” live demo dashboard and capture the query when 1) the panel was not repeated and 2) when it was repeated over $host:

  1. Panel is not repeated - the parameter is quoted and surrounded in parentheses.: ““query”:”@hostname:(\“server\\ 20\”)""

    {
    “request”: {
    “method”: “POST”,
    “url”: “api/datasources/proxy/3/_msearch”,
    “data”: “{“search_type”:“query_then_fetch”,“ignore_unavailable”:true,“index”:[“metrics-2017.10.18”]}\n{“size”:0,“query”:{“bool”:{“filter”:[{“range”:{”@timestamp":{“gte”:“1508362785750”,“lte”:“1508363085751”,“format”:“epoch_millis”}}},{“query_string”:{“analyze_wildcard”:true,“query”:"@hostname:(\“server\\ 20\”)"}}]}},“aggs”:{“3”:{“terms”:{“field”:"@hostname",“size”:5,“order”:{“1”:“asc”},“min_doc_count”:1},“aggs”:{“1”:{“max”:{“field”:"@value"}},“2”:{“date_histogram”:{“interval”:“500ms”,“field”:"@timestamp",“min_doc_count”:0,“extended_bounds”:{“min”:“1508362785750”,“max”:“1508363085751”},“format”:“epoch_millis”},“aggs”:{“1”:{“max”:{“field”:"@value"}}}}}}}}\n"
    }
    }

  2. Panel is repeated for $host: ““query”:”@hostname:server\\ 20""
    {
    “request”: {
    “method”: “POST”,
    “url”: “api/datasources/proxy/3/_msearch”,
    “data”: “{“search_type”:“query_then_fetch”,“ignore_unavailable”:true,“index”:[“metrics-2017.10.18”]}\n{“size”:0,“query”:{“bool”:{“filter”:[{“range”:{”@timestamp":{“gte”:“1508362553004”,“lte”:“1508362853004”,“format”:“epoch_millis”}}},{“query_string”:{“analyze_wildcard”:true,“query”:"@hostname:server\\ 20"}}]}},“aggs”:{“3”:{“terms”:{“field”:"@hostname",“size”:5,“order”:{“1”:“asc”},“min_doc_count”:1},“aggs”:{“1”:{“max”:{“field”:"@value"}},“2”:{“date_histogram”:{“interval”:“500ms”,“field”:"@timestamp",“min_doc_count”:0,“extended_bounds”:{“min”:“1508362553004”,“max”:“1508362853004”},“format”:“epoch_millis”},“aggs”:{“1”:{“max”:{“field”:"@value"}}}}}}}}\n"
    }
    }

Is this by design for some reason? How can I force the quotes?

Thanks.
Vamsi.


UPDATE

I believe the quotes and parentheses are added around a single selected value in the query only if the template’s selection options include “Multi-value”

Yes that is correct multi value needs to be enclosed like this

Hi, torkel. I don’t deny that. And whenever multiple values are plugged into the query, they are quoted and parenthesized as expected (not just for multiple values selected in a multi-value list but also when “All” is selected for non-multi-value list allowing the “All” option). e.g., “query”:"@hostname:(\“server\\ 20\” OR \“server\“21\” OR \“server1\” OR \“server2\”)”

What I observed is that if only one value is selected, it’s not quoted. See the second example in my post (the query part is “query”:”@hostname:server\\ 20" (no quotes, no parentheses) and this is what’s causing the problem…

It should be “query”:”@hostname:(\“server\\ 20\”)" no matter the selection options. No?

Thanks.
V.

Single values don’t need to be quoted?

Sorry if I caused confusion. I’m saying they should be quoted. Suppose the value is not one word but a phrase or has spaces/punctuation/etc., (as “server 20” in my example) and the field is analyzed!

Here are two elasticsearch query examples. The field involved (log_context_1) is of type “text” and is analyzed. The first doesn’t quote the value and the second does - and they result in different hits.total: