# Boolean operators entered in lower case returning unexpected results **URL:** \ **Category:** Elasticsearch\ **Created:** [December 13, 2011, 11:45am UTC](https://discuss.elastic.co/t/boolean-operators-entered-in-lower-case-returning-unexpected-results/6139 "2011-12-13T11:45:33Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![kranti\_vns](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@kranti\_vns](https://discuss.elastic.co/u/kranti_vns)\ **Post date:** [December 13, 2011, 11:45am UTC](https://discuss.elastic.co/t/boolean-operators-entered-in-lower-case-returning-unexpected-results/6139/1 "2011-12-13T11:45:33Z")
Hi Team, We are facing an issue when query string consists of Boolean operators (AND, OR and NOT) in lower case.For e. g. when following query is fired on ES server we are getting back the results even when there is no such data available. Query : curl -XGET [http://localhost:9200/\_search?pretty=1](http://localhost:9200/_search?pretty=1) -d '{ "from" : 0, "size" : 5, "query" : { "filtered" : { "query" : { "query\_string" : { "query" : "message:snort message:and", "default\_operator" : "and", "analyzer" : "search\_analyzer", "allow\_leading\_wildcard" : false, "analyze\_wildcard" : true } }, "filter" : { "range" : { "date" : { "from" : "2011/08/01 00:00:00", "to" : "2011/08/15 23:59:59", "include\_lower" : true, "include\_upper" : false } } } } }, "explain" : true, "sort" : [ { "date" : { "order" : "desc" } } ] }' As can be seen that default operator is AND.We don't have any message which has both "snort" and "and", still we are getting back the result.Following is the explain obtained : { "took" : 348, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 4692830, "max\_score" : null, "hits" : [ { "\_shard" : 0, "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", "\_index" : "20110812", "\_type" : "syslog", "\_id" : "1313209533-195322", "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:58", "host" : "hallmark-snrt-008", "message" : "Aug 12 23:59:58 hallmark-snrt-008 snort[14387]: [1:402:8] ICMP Destination Unreachable Port Unreachable [Classification: Misc activity] [Priority: 3] {ICMP} 10.27.32.46 -\> 172.17.1.26", "service" : "snort", "sip" : "10.27.32.46", "dip" : "172.17.1.26", "sigid" : "1:402", "signame" : "ICMP Destination Unreachable Port Unreachable", "app" : "Snort IDS", "ips-severity" : "3", "ips-category" : "Misc activity" }, "sort" : [1313193598000], "\_explanation" : { "value" : 1.0179296, "description" : "fieldWeight(message:snort in 4660), product of:", "details" : [ { "value" : 1.0, "description" : "tf(termFreq(message:snort)=1)" }, { "value" : 1.0179296, "description" : "idf(docFreq=98223, maxDocs=100001)" }, { "value" : 1.0, "description" : "fieldNorm(field=message, doc=4660)" } ] } }, { "\_shard" : 0, "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", "\_index" : "20110812", "\_type" : "syslog", "\_id" : "1313209533-195324", "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:58", "host" : "hallmark-snrt-008", "message" : "Aug 12 23:59:58 hallmark-snrt-008 snort[14387]: [1:402:8] ICMP Destination Unreachable Port Unreachable [Classification: Misc activity] [Priority: 3] {ICMP} 10.27.32.46 -\> 172.17.1.26", "service" : "snort", "sip" : "10.27.32.46", "dip" : "172.17.1.26", "sigid" : "1:402", "signame" : "ICMP Destination Unreachable Port Unreachable", "app" : "Snort IDS", "ips-severity" : "3", "ips-category" : "Misc activity" }, "sort" : [1313193598000], "\_explanation" : { "value" : 1.0179296, "description" : "fieldWeight(message:snort in 4661), product of:", "details" : [ { "value" : 1.0, "description" : "tf(termFreq(message:snort)=1)" }, { "value" : 1.0179296, "description" : "idf(docFreq=98223, maxDocs=100001)" }, { "value" : 1.0, "description" : "fieldNorm(field=message, doc=4661)" } ] } }, { "\_shard" : 0, "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", "\_index" : "20110812", "\_type" : "syslog", "\_id" : "1313209533-195318", "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:56", "host" : "hallmark-snrt-008", "message" : "Aug 12 23:59:56 hallmark-snrt-008 snort[14387]: [1:254:9] DNS SPOOF query response with TTL of 1 min. and no authority [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 162.94.3.251:53 -\> 192.168.40.40:58602", "service" : "snort", "sip" : "162.94.3.251", "dip" : "192.168.40.40", "dport" : "58602", "sigid" : "1:254", "signame" : "DNS SPOOF query response with TTL of 1 min. and no authority", "app" : "Snort IDS", "ips-severity" : "2", "ips-category" : "Potentially Bad Traffic" }, "sort" : [1313193596000], "\_explanation" : { "value" : 1.0179296, "description" : "fieldWeight(message:snort in 4658), product of:", "details" : [ { "value" : 1.0, "description" : "tf(termFreq(message:snort)=1)" }, { "value" : 1.0179296, "description" : "idf(docFreq=98223, maxDocs=100001)" }, { "value" : 1.0, "description" : "fieldNorm(field=message, doc=4658)" } ] } }, { "\_shard" : 0, "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", "\_index" : "20110812", "\_type" : "syslog", "\_id" : "1313209533-195320", "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:56", "host" : "hallmark-snrt-008", "message" : "Aug 12 23:59:56 hallmark-snrt-008 snort[14387]: [1:254:9] DNS SPOOF query response with TTL of 1 min. and no authority [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 162.94.3.251:53 -\> 192.168.40.40:58602", "service" : "snort", "sip" : "162.94.3.251", "dip" : "192.168.40.40", "dport" : "58602", "sigid" : "1:254", "signame" : "DNS SPOOF query response with TTL of 1 min. and no authority", "app" : "Snort IDS", "ips-severity" : "2", "ips-category" : "Potentially Bad Traffic" }, "sort" : [1313193596000], "\_explanation" : { "value" : 1.0179296, "description" : "fieldWeight(message:snort in 4659), product of:", "details" : [ { "value" : 1.0, "description" : "tf(termFreq(message:snort)=1)" }, { "value" : 1.0179296, "description" : "idf(docFreq=98223, maxDocs=100001)" }, { "value" : 1.0, "description" : "fieldNorm(field=message, doc=4659)" } ] } }, { "\_shard" : 0, "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", "\_index" : "20110812", "\_type" : "syslog", "\_id" : "1313209533-195310", "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:55", "host" : "hallmark-snrt-008", "message" : "Aug 12 23:59:55 hallmark-snrt-008 snort[14387]: [1:384:5] ICMP PING [Classification: Misc activity] [Priority: 3] {ICMP} 192.168.114.189 -\> 10.15.1.103", "service" : "snort", "sip" : "192.168.114.189", "dip" : "10.15.1.103", "sigid" : "1:384", "signame" : "ICMP PING", "app" : "Snort IDS", "ips-severity" : "3", "ips-category" : "Misc activity" }, "sort" : [1313193595000], "\_explanation" : { "value" : 1.0179296, "description" : "fieldWeight(message:snort in 4654), product of:", "details" : [ { "value" : 1.0, "description" : "tf(termFreq(message:snort)=1)" }, { "value" : 1.0179296, "description" : "idf(docFreq=98223, maxDocs=100001)" }, { "value" : 1.0, "description" : "fieldNorm(field=message, doc=4654)" } ] } } ] } As it can be seen that it is not accounting for "and", only for "snort". Please let us know the cause for such unexpected behavior. Same behavior is seen when we entered query like following which look for literal string "snort AND" curl -XGET [http://localhost:9200/\_search?pretty=1](http://localhost:9200/_search?pretty=1) -d '{ "from" : 0, "size" : 2, "query" : { "filtered" : { "query" : { "query\_string" : { "query" : ""snort AND"", "default\_operator" : "and", "analyzer" : "search\_analyzer", "allow\_leading\_wildcard" : false, "analyze\_wildcard" : true } }, "filter" : { "range" : { "date" : { "from" : "2011/08/01 00:00:00", "to" : "2011/08/15 23:59:59", "include\_lower" : true, "include\_upper" : false } } } } }, "explain" : true, "sort" : [ { "date" : { "order" : "desc" } } ] }' The explain is : { "took" : 1029, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 4692830, "max\_score" : null, "hits" : [ { "\_shard" : 0, "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", "\_index" : "20110812", "\_type" : "syslog", "\_id" : "1313209533-195322", "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:58", "host" : "hallmark-snrt-008", "message" : "Aug 12 23:59:58 hallmark-snrt-008 snort[14387]: [1:402:8] ICMP Destination Unreachable Port Unreachable [Classification: Misc activity] [Priority: 3] {ICMP} 10.27.32.46 -\> 172.17.1.26", "service" : "snort", "sip" : "10.27.32.46", "dip" : "172.17.1.26", "sigid" : "1:402", "signame" : "ICMP Destination Unreachable Port Unreachable", "app" : "Snort IDS", "ips-severity" : "3", "ips-category" : "Misc activity" }, "sort" : [1313193598000], "\_explanation" : { "value" : 0.15583801, "description" : "fieldWeight(\_all:snort in 4660), product of:", "details" : [ { "value" : 1.2247449, "description" : "btq, product of:", "details" : [ { "value" : 1.2247449, "description" : "tf(phraseFreq=1.5)" }, { "value" : 1.0, "description" : "allPayload(...)" } ] }, { "value" : 1.0179296, "description" : "idf(\_all: snort=98223)" }, { "value" : 0.125, "description" : "fieldNorm(field=\_all, doc=4660)" } ] } }, { "\_shard" : 0, "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", "\_index" : "20110812", "\_type" : "syslog", "\_id" : "1313209533-195324", "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:58", "host" : "hallmark-snrt-008", "message" : "Aug 12 23:59:58 hallmark-snrt-008 snort[14387]: [1:402:8] ICMP Destination Unreachable Port Unreachable [Classification: Misc activity] [Priority: 3] {ICMP} 10.27.32.46 -\> 172.17.1.26", "service" : "snort", "sip" : "10.27.32.46", "dip" : "172.17.1.26", "sigid" : "1:402", "signame" : "ICMP Destination Unreachable Port Unreachable", "app" : "Snort IDS", "ips-severity" : "3", "ips-category" : "Misc activity" }, "sort" : [1313193598000], "\_explanation" : { "value" : 0.15583801, "description" : "fieldWeight(\_all:snort in 4661), product of:", "details" : [ { "value" : 1.2247449, "description" : "btq, product of:", "details" : [ { "value" : 1.2247449, "description" : "tf(phraseFreq=1.5)" }, { "value" : 1.0, "description" : "allPayload(...)" } ] }, { "value" : 1.0179296, "description" : "idf(\_all: snort=98223)" }, { "value" : 0.125, "description" : "fieldNorm(field=\_all, doc=4661)" } ] } } ] } There is nothing like exact literal string "snort AND" in message, still we are getting back the data.The "AND" is completely overlooked as can be seen from the explain. If we search something like "snort abc" we are not getting back data as there is no such literal string.Its only when we enter something like "snot and" or "snort not" we are getting back data. Please suggest how to handle lower case Boolean operators "and", "or" and "not".Also how should we handle Boolean operators "AND","OR" and "NOT" when they are part of literal string. Thanks Kranti ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [December 13, 2011, 10:43pm UTC](https://discuss.elastic.co/t/boolean-operators-entered-in-lower-case-returning-unexpected-results/6139/2 "2011-12-13T22:43:01Z")
Its not because and is a boolean operation, its because its a stop word, and its removed during the analysis process. So the text: "dog and cat" will be broken down into terms: "dog", "cat" by the standard analyzed. You can build your own analyzed that does not remove stopwords. On Tue, Dec 13, 2011 at 1:45 PM, kranti.vns [kranti.vns@gmail.com](mailto:kranti.vns@gmail.com) wrote: > Hi Team, > > We are facing an issue when query string consists of Boolean operators > (AND, > OR and NOT) in lower case.For e. g. when following query is fired on ES > server we are getting back the results even when there is no such data > available. > > Query : > > curl -XGET [http://localhost:9200/\_search?pretty=1](http://localhost:9200/_search?pretty=1) -d '{ > "from" : 0, > "size" : 5, > "query" : { > "filtered" : { > "query" : { > "query\_string" : { > "query" : "message:snort message:and", > "default\_operator" : "and", > "analyzer" : "search\_analyzer", > "allow\_leading\_wildcard" : false, > "analyze\_wildcard" : true > } > }, > "filter" : { > "range" : { > "date" : { > "from" : "2011/08/01 00:00:00", > "to" : "2011/08/15 23:59:59", > "include\_lower" : true, > "include\_upper" : false > } > } > } > } > }, > "explain" : true, > "sort" : [ { > "date" : { > "order" : "desc" > } > } ] > }' > > As can be seen that default operator is AND.We don't have any message which > has both "snort" and "and", still we are getting back the result.Following > is the explain obtained : > > { > "took" : 348, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 4692830, > "max\_score" : null, > "hits" : [ { > "\_shard" : 0, > "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", > "\_index" : "20110812", > "\_type" : "syslog", > "\_id" : "1313209533-195322", > "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:58", "host" > : "hallmark-snrt-008", "message" : "Aug 12 23:59:58 hallmark-snrt-008 > snort[14387]: [1:402:8] ICMP Destination Unreachable Port Unreachable > [Classification: Misc activity] [Priority: 3] {ICMP} 10.27.32.46 -\> > 172.17.1.26", "service" : "snort", "sip" : "10.27.32.46", "dip" : > "172.17.1.26", "sigid" : "1:402", "signame" : "ICMP Destination > Unreachable Port Unreachable", "app" : "Snort IDS", "ips-severity" : "3", > "ips-category" : "Misc activity" }, > "sort" : [1313193598000], > "\_explanation" : { > "value" : 1.0179296, > "description" : "fieldWeight(message:snort in 4660), product of:", > "details" : [ { > "value" : 1.0, > "description" : "tf(termFreq(message:snort)=1)" > }, { > "value" : 1.0179296, > "description" : "idf(docFreq=98223, maxDocs=100001)" > }, { > "value" : 1.0, > "description" : "fieldNorm(field=message, doc=4660)" > } ] > } > }, { > "\_shard" : 0, > "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", > "\_index" : "20110812", > "\_type" : "syslog", > "\_id" : "1313209533-195324", > "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:58", "host" > : "hallmark-snrt-008", "message" : "Aug 12 23:59:58 hallmark-snrt-008 > snort[14387]: [1:402:8] ICMP Destination Unreachable Port Unreachable > [Classification: Misc activity] [Priority: 3] {ICMP} 10.27.32.46 -\> > 172.17.1.26", "service" : "snort", "sip" : "10.27.32.46", "dip" : > "172.17.1.26", "sigid" : "1:402", "signame" : "ICMP Destination > Unreachable Port Unreachable", "app" : "Snort IDS", "ips-severity" : "3", > "ips-category" : "Misc activity" }, > "sort" : [1313193598000], > "\_explanation" : { > "value" : 1.0179296, > "description" : "fieldWeight(message:snort in 4661), product of:", > "details" : [ { > "value" : 1.0, > "description" : "tf(termFreq(message:snort)=1)" > }, { > "value" : 1.0179296, > "description" : "idf(docFreq=98223, maxDocs=100001)" > }, { > "value" : 1.0, > "description" : "fieldNorm(field=message, doc=4661)" > } ] > } > }, { > "\_shard" : 0, > "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", > "\_index" : "20110812", > "\_type" : "syslog", > "\_id" : "1313209533-195318", > "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:56", "host" > : "hallmark-snrt-008", "message" : "Aug 12 23:59:56 hallmark-snrt-008 > snort[14387]: [1:254:9] DNS SPOOF query response with TTL of 1 min. and no > authority [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} > 162.94.3.251:53 -\> 192.168.40.40:58602", "service" : "snort", "sip" : > "162.94.3.251", "dip" : "192.168.40.40", "dport" : "58602", "sigid" : > "1:254", "signame" : "DNS SPOOF query response with TTL of 1 min. and no > authority", "app" : "Snort IDS", "ips-severity" : "2", "ips-category" : > "Potentially Bad Traffic" }, > "sort" : [1313193596000], > "\_explanation" : { > "value" : 1.0179296, > "description" : "fieldWeight(message:snort in 4658), product of:", > "details" : [ { > "value" : 1.0, > "description" : "tf(termFreq(message:snort)=1)" > }, { > "value" : 1.0179296, > "description" : "idf(docFreq=98223, maxDocs=100001)" > }, { > "value" : 1.0, > "description" : "fieldNorm(field=message, doc=4658)" > } ] > } > }, { > "\_shard" : 0, > "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", > "\_index" : "20110812", > "\_type" : "syslog", > "\_id" : "1313209533-195320", > "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:56", "host" > : "hallmark-snrt-008", "message" : "Aug 12 23:59:56 hallmark-snrt-008 > snort[14387]: [1:254:9] DNS SPOOF query response with TTL of 1 min. and no > authority [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} > 162.94.3.251:53 -\> 192.168.40.40:58602", "service" : "snort", "sip" : > "162.94.3.251", "dip" : "192.168.40.40", "dport" : "58602", "sigid" : > "1:254", "signame" : "DNS SPOOF query response with TTL of 1 min. and no > authority", "app" : "Snort IDS", "ips-severity" : "2", "ips-category" : > "Potentially Bad Traffic" }, > "sort" : [1313193596000], > "\_explanation" : { > "value" : 1.0179296, > "description" : "fieldWeight(message:snort in 4659), product of:", > "details" : [ { > "value" : 1.0, > "description" : "tf(termFreq(message:snort)=1)" > }, { > "value" : 1.0179296, > "description" : "idf(docFreq=98223, maxDocs=100001)" > }, { > "value" : 1.0, > "description" : "fieldNorm(field=message, doc=4659)" > } ] > } > }, { > "\_shard" : 0, > "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", > "\_index" : "20110812", > "\_type" : "syslog", > "\_id" : "1313209533-195310", > "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:55", "host" > : "hallmark-snrt-008", "message" : "Aug 12 23:59:55 hallmark-snrt-008 > snort[14387]: [1:384:5] ICMP PING [Classification: Misc activity] > [Priority: > 3] {ICMP} 192.168.114.189 -\> 10.15.1.103", "service" : "snort", "sip" : > "192.168.114.189", "dip" : "10.15.1.103", "sigid" : "1:384", "signame" : > "ICMP PING", "app" : "Snort IDS", "ips-severity" : "3", "ips-category" : > "Misc activity" }, > "sort" : [1313193595000], > "\_explanation" : { > "value" : 1.0179296, > "description" : "fieldWeight(message:snort in 4654), product of:", > "details" : [ { > "value" : 1.0, > "description" : "tf(termFreq(message:snort)=1)" > }, { > "value" : 1.0179296, > "description" : "idf(docFreq=98223, maxDocs=100001)" > }, { > "value" : 1.0, > "description" : "fieldNorm(field=message, doc=4654)" > } ] > } > } ] > } > > As it can be seen that it is not accounting for "and", only for "snort". > > Please let us know the cause for such unexpected behavior. > > Same behavior is seen when we entered query like following which look for > literal string "snort AND" > > curl -XGET [http://localhost:9200/\_search?pretty=1](http://localhost:9200/_search?pretty=1) -d '{ > "from" : 0, > "size" : 2, > "query" : { > "filtered" : { > "query" : { > "query\_string" : { > "query" : ""snort AND"", > "default\_operator" : "and", > "analyzer" : "search\_analyzer", > "allow\_leading\_wildcard" : false, > "analyze\_wildcard" : true > } > }, > "filter" : { > "range" : { > "date" : { > "from" : "2011/08/01 00:00:00", > "to" : "2011/08/15 23:59:59", > "include\_lower" : true, > "include\_upper" : false > } > } > } > } > }, > "explain" : true, > "sort" : [ { > "date" : { > "order" : "desc" > } > } ] > }' > > The explain is : > > { > "took" : 1029, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 4692830, > "max\_score" : null, > "hits" : [ { > "\_shard" : 0, > "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", > "\_index" : "20110812", > "\_type" : "syslog", > "\_id" : "1313209533-195322", > "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:58", "host" > : "hallmark-snrt-008", "message" : "Aug 12 23:59:58 hallmark-snrt-008 > snort[14387]: [1:402:8] ICMP Destination Unreachable Port Unreachable > [Classification: Misc activity] [Priority: 3] {ICMP} 10.27.32.46 -\> > 172.17.1.26", "service" : "snort", "sip" : "10.27.32.46", "dip" : > "172.17.1.26", "sigid" : "1:402", "signame" : "ICMP Destination > Unreachable Port Unreachable", "app" : "Snort IDS", "ips-severity" : "3", > "ips-category" : "Misc activity" }, > "sort" : [1313193598000], > "\_explanation" : { > "value" : 0.15583801, > "description" : "fieldWeight(\_all:snort in 4660), product of:", > "details" : [ { > "value" : 1.2247449, > "description" : "btq, product of:", > "details" : [ { > "value" : 1.2247449, > "description" : "tf(phraseFreq=1.5)" > }, { > "value" : 1.0, > "description" : "allPayload(...)" > } ] > }, { > "value" : 1.0179296, > "description" : "idf(\_all: snort=98223)" > }, { > "value" : 0.125, > "description" : "fieldNorm(field=\_all, doc=4660)" > } ] > } > }, { > "\_shard" : 0, > "\_node" : "fvTUBsH4SRWZlAiw6ZSr\_Q", > "\_index" : "20110812", > "\_type" : "syslog", > "\_id" : "1313209533-195324", > "\_score" : null, "\_source" : { "date" : "2011/08/12 23:59:58", "host" > : "hallmark-snrt-008", "message" : "Aug 12 23:59:58 hallmark-snrt-008 > snort[14387]: [1:402:8] ICMP Destination Unreachable Port Unreachable > [Classification: Misc activity] [Priority: 3] {ICMP} 10.27.32.46 -\> > 172.17.1.26", "service" : "snort", "sip" : "10.27.32.46", "dip" : > "172.17.1.26", "sigid" : "1:402", "signame" : "ICMP Destination > Unreachable Port Unreachable", "app" : "Snort IDS", "ips-severity" : "3", > "ips-category" : "Misc activity" }, > "sort" : [1313193598000], > "\_explanation" : { > "value" : 0.15583801, > "description" : "fieldWeight(\_all:snort in 4661), product of:", > "details" : [ { > "value" : 1.2247449, > "description" : "btq, product of:", > "details" : [ { > "value" : 1.2247449, > "description" : "tf(phraseFreq=1.5)" > }, { > "value" : 1.0, > "description" : "allPayload(...)" > } ] > }, { > "value" : 1.0179296, > "description" : "idf(\_all: snort=98223)" > }, { > "value" : 0.125, > "description" : "fieldNorm(field=\_all, doc=4661)" > } ] > } > } ] > } > > There is nothing like exact literal string "snort AND" in message, still we > are getting back the data.The "AND" is completely overlooked as can be seen > from the explain. > > If we search something like "snort abc" we are not getting back data as > there is no such literal string.Its only when we enter something like "snot > and" or "snort not" we are getting back data. > > Please suggest how to handle lower case Boolean operators "and", "or" and > "not".Also how should we handle Boolean operators "AND","OR" and "NOT" when > they are part of literal string. > > Thanks > Kranti > > -- > View this message in context: > [http://elasticsearch-users.115913.n3.nabble.com/Boolean-operators-entered-in-lower-case-returning-unexpected-results-tp3582092p3582092.html](http://elasticsearch-users.115913.n3.nabble.com/Boolean-operators-entered-in-lower-case-returning-unexpected-results-tp3582092p3582092.html) > Sent from the Elasticsearch Users mailing list archive at [Nabble.com](http://Nabble.com). ---
**Author:** ![ElasticUsers](https://avatars.discourse-cdn.com/v4/letter/e/51bf81/32.png) [@ElasticUsers](https://discuss.elastic.co/u/ElasticUsers)\ **Post date:** [January 6, 2012, 7:25am UTC](https://discuss.elastic.co/t/boolean-operators-entered-in-lower-case-returning-unexpected-results/6139/3 "2012-01-06T07:25:21Z")
Hi Shay, I am using ES Java API for searching.Please let me know how can I specify analyzer while searching using Java API. Also it would be a great help if you could tell how and where should I specify analyzer while creating indices. Thanks ---
**Author:** ![ElasticUsers](https://avatars.discourse-cdn.com/v4/letter/e/51bf81/32.png) [@ElasticUsers](https://discuss.elastic.co/u/ElasticUsers)\ **Post date:** [January 9, 2012, 6:36am UTC](https://discuss.elastic.co/t/boolean-operators-entered-in-lower-case-returning-unexpected-results/6139/4 "2012-01-09T06:36:55Z")
Any inputs/suggestions on this? ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [January 9, 2012, 8:00pm UTC](https://discuss.elastic.co/t/boolean-operators-entered-in-lower-case-returning-unexpected-results/6139/5 "2012-01-09T20:00:38Z")
First, don't send the mail on another thread, it has nothing to do with this thread. You can specify an analyzer when you search based on the query type that you use. For example, query\_string accepts an analyzer option. You can specify a default analyzer in your index config, which will be used for all (string) fields by default. you, you can specify an analyzer associated with a field in the mapping. On Fri, Jan 6, 2012 at 9:25 AM, ElasticUsers [kranti\_123@rediffmail.com](mailto:kranti_123@rediffmail.com)wrote: > Hi Shay, > > I am using ES Java API for searching.Please let me know how can I specify > analyzer while searching using Java API. > > Also it would be a great help if you could tell how and where should I > specify analyzer while creating indices. > > Thanks > > -- > View this message in context: > [http://elasticsearch-users.115913.n3.nabble.com/Boolean-operators-entered-in-lower-case-returning-unexpected-results-tp3582092p3637252.html](http://elasticsearch-users.115913.n3.nabble.com/Boolean-operators-entered-in-lower-case-returning-unexpected-results-tp3582092p3637252.html) > Sent from the Elasticsearch Users mailing list archive at [Nabble.com](http://Nabble.com). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 3:43am UTC](https://discuss.elastic.co/t/boolean-operators-entered-in-lower-case-returning-unexpected-results/6139/6 "2017-07-06T03:43:19Z")