Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Impossible to search for documents containing "??" in a property #6561

Closed
jeremycohensolal opened this issue Mar 17, 2016 · 2 comments
Closed

Comments

@jeremycohensolal
Copy link

Hello

I want to retrieve all documents containing IPCOUNTRY=?? but it doesn't work.

I tried in discover the following

  • IPCOUNTRY:?? => ? is evaluated > returns all records > normal case-
  • IPCOUNTRY:?? => Doesn't return any document... but lucene documentation says it should be the good way of achieving this...
  • IPCOUNTRY:"??" => doesnt work
  • IPCOUNTRY:'??' => doesnt work
  • IPCOUNTRY:/[^A-Z]{2}/

The strange thing is that

  • exists:_type AND IPCOUNTRY:?? => returns all documents but IPCOUNTRY:?? returns nothing...

My ELK stack is :

  • KIBANA: Version 4.4.1 / Build 9693
  • ELASTICSEARCH: Version 2.2.0
@jeremycohensolal jeremycohensolal changed the title Impossible to search for documents containing "??" in a properties Impossible to search for documents containing "??" in a property Mar 17, 2016
@rashidkpc
Copy link
Contributor

This is an elasticsearch mapping issue. Punctuation is dropped. You'll need to set your field to an analyzer that would keep ?. Maybe keyword? or not_analyzed?

@jeremycohensolal
Copy link
Author

in fact this doesnt seems to be dropped, when I display all IPCOUNTRY parameters, I can see "??" when some records have unknown IP

But I am unable to create a filter for this value. Do you think I still have to change the analyzer?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants