# Can't find a value that is the letter 'a' - Please Read **URL:** \ **Category:** Elasticsearch\ **Created:** [July 17, 2013, 3:57am UTC](https://discuss.elastic.co/t/cant-find-a-value-that-is-the-letter-a-please-read/12816 "2013-07-17T03:57:06Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Kai\_Cherry](https://avatars.discourse-cdn.com/v4/letter/k/ecb155/32.png) [@Kai\_Cherry](https://discuss.elastic.co/u/Kai_Cherry)\ **Post date:** [July 17, 2013, 3:57am UTC](https://discuss.elastic.co/t/cant-find-a-value-that-is-the-letter-a-please-read/12816/1 "2013-07-17T03:57:06Z")
There is probably some reason for this. We don't understand what that reason might be and it has caused some ES adoption "controversy" at our shop. The Problem: A JSON document stored with value of the single letter 'a' cannot be found in a search. Eg, "visitorDisplayName" : "a" Stay with me here... The Recipe: curl -XPUT [http://localhost:9200/visitors/logEntry/\_mapping](http://localhost:9200/visitors/logEntry/_mapping) -d' { "logEntry": { "properties": { "deleted": { "type": "boolean" }, "hostDisplayName": { "type": "string" }, "isEmployee": { "type": "boolean" }, "locationID": { "type": "string" }, "passIdentifier": { "type": "string" }, "timeIn": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ssZZ" }, "timeOut": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ssZZ" }, "visitorCompanyName": { "type": "string" }, "visitorDisplayName": { "type": "string" }, "visitorPhoneNumber": { "type": "string" } } } } ' No problems here. So let's put something in there: curl -XPOST [http://localhost:9200/visitors/logEntry](http://localhost:9200/visitors/logEntry) -d' \* {"timeOut":null,"visitorPhoneNumber":null,"timeIn":"2013-07-16T18:18:23-0700","isEmployee":true,"visitorDisplayName":"a","hostDisplayName":null,"logEntryID":null,"hostPhoneNumber":null,"visitorFirstName":null,"hostLastName":null,"hostEmailID":null,"hostFirstName":null,"visitorLastName":null,"locationID":"g9Xc-E-3TNmbyHBg8y\_ctg","visitorCompanyName":null,"deleted":false,"passIdentifier":"10ED9802-F24C-4D42-A7E3-B78493C19DDC"} \* ' All good. Standard stuff. Here's the thing: no query can retrieve this document via \* "visitorDisplayName":"a"\*... not via \_search?q=visitorDisplayName:a Nor this POSTed one: { "query": { "term" : { "visitorDisplayName" : "a" } } } Now...before you tell me how ridiculous that is...hang on...because if visitorDisplayName is "b" or "c" or "d" or...this actually does what one expects. The question is...why/how can this happen? Any insight would be greatly appreciated and thanks in advance! -K -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![zerocoolys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerocoolys/32/44918_2.png) [@zerocoolys](https://discuss.elastic.co/u/zerocoolys)\ **Post date:** [July 17, 2013, 5:57am UTC](https://discuss.elastic.co/t/cant-find-a-value-that-is-the-letter-a-please-read/12816/2 "2013-07-17T05:57:46Z")
try to set the visitorDisplayName to " **not\_analyzed**" There is probably some reason for this. We don't understand what that reason might be and it has caused some ES adoption "controversy" at our shop. The Problem: A JSON document stored with value of the single letter 'a' cannot be found in a search. Eg, "visitorDisplayName" : "a" Stay with me here... The Recipe: curl -XPUT [http://localhost:9200/visitors/logEntry/\_mapping](http://localhost:9200/visitors/logEntry/_mapping) -d' { "logEntry": { "properties": { "deleted": { "type": "boolean" }, "hostDisplayName": { "type": "string" }, "isEmployee": { "type": "boolean" }, "locationID": { "type": "string" }, "passIdentifier": { "type": "string" }, "timeIn": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ssZZ" }, "timeOut": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ssZZ" }, "visitorCompanyName": { "type": "string" }, "visitorDisplayName": { "type": "string" }, "visitorPhoneNumber": { "type": "string" } } } } ' No problems here. So let's put something in there: curl -XPOST [http://localhost:9200/visitors/logEntry](http://localhost:9200/visitors/logEntry) -d' \* {"timeOut":null,"visitorPhoneNumber":null,"timeIn":"2013-07-16T18:18:23-0700","isEmployee":true,"visitorDisplayName":"a","hostDisplayName":null,"logEntryID":null,"hostPhoneNumber":null,"visitorFirstName":null,"hostLastName":null,"hostEmailID":null,"hostFirstName":null,"visitorLastName":null,"locationID":"g9Xc-E-3TNmbyHBg8y\_ctg","visitorCompanyName":null,"deleted":false,"passIdentifier":"10ED9802-F24C-4D42-A7E3-B78493C19DDC"} \* ' All good. Standard stuff. Here's the thing: no query can retrieve this document via \* "visitorDisplayName":"a"\*... not via \_search?q=visitorDisplayName:a Nor this POSTed one: { "query": { "term" : { "visitorDisplayName" : "a" } } } Now...before you tell me how ridiculous that is...hang on...because if visitorDisplayName is "b" or "c" or "d" or...this actually does what one expects. The question is...why/how can this happen? Any insight would be greatly appreciated and thanks in advance! -K -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@. For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [July 17, 2013, 6:27am UTC](https://discuss.elastic.co/t/cant-find-a-value-that-is-the-letter-a-please-read/12816/3 "2013-07-17T06:27:11Z")
Hey, the reason why this happens: Your havent defined a custom analyzer on your string fields, so the standard analyzer is chosen by elasticsearch automatically. The standard analyzer contains a stop word filter, which removes common words from a field before the field is indexed. Words like 'this', 'a', 'an', 'the' are removed in that process. And this is exactly the reason you cannot search for it anymore, as they are not stored in the dataset which is searched. On more information about how to change your analysis process, take a look at the documentation., starting here > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. Setting the visitorDisplayName to not\_analyzed will result in your field not being tokenized and split at all, which is most likely not what you want, but mileage may vary... --Alex On Wed, Jul 17, 2013 at 5:57 AM, Kai Cherry [rnsksoft@gmail.com](mailto:rnsksoft@gmail.com) wrote: > There is probably some reason for this. We don't understand what that > reason might be and it has caused some ES adoption "controversy" at our > shop. > > The Problem: > > A JSON document stored with value of the single letter 'a' cannot be found > in a search. Eg, "visitorDisplayName" : "a" > > Stay with me here... > > The Recipe: > > curl -XPUT [http://localhost:9200/visitors/logEntry/\_mapping](http://localhost:9200/visitors/logEntry/_mapping) -d' > { > "logEntry": { > "properties": { > "deleted": { > "type": "boolean" > }, > "hostDisplayName": { > "type": "string" > }, > "isEmployee": { > "type": "boolean" > }, > "locationID": { > "type": "string" > }, > "passIdentifier": { > "type": "string" > }, > "timeIn": { > "type": "date", > "format": "yyyy-MM-dd'T'HH:mm:ssZZ" > }, > "timeOut": { > "type": "date", > "format": "yyyy-MM-dd'T'HH:mm:ssZZ" > }, > "visitorCompanyName": { > "type": "string" > }, > "visitorDisplayName": { > "type": "string" > }, > "visitorPhoneNumber": { > "type": "string" > } > } > } > } > ' > > No problems here. So let's put something in there: > > curl -XPOST [http://localhost:9200/visitors/logEntry](http://localhost:9200/visitors/logEntry) -d' > \* > {"timeOut":null,"visitorPhoneNumber":null,"timeIn":"2013-07-16T18:18:23-0700","isEmployee":true,"visitorDisplayName":"a","hostDisplayName":null,"logEntryID":null,"hostPhoneNumber":null,"visitorFirstName":null,"hostLastName":null,"hostEmailID":null,"hostFirstName":null,"visitorLastName":null,"locationID":"g9Xc-E-3TNmbyHBg8y\_ctg","visitorCompanyName":null,"deleted":false,"passIdentifier":"10ED9802-F24C-4D42-A7E3-B78493C19DDC"} > \* > ' > All good. Standard stuff. > > Here's the thing: no query can retrieve this document via \* > "visitorDisplayName":"a"\*... not via \_search?q=visitorDisplayName:a > > Nor this POSTed one: > > { > "query": { > "term" : { > "visitorDisplayName" : "a" > } > } > } > > Now...before you tell me how ridiculous that is...hang on...because if > visitorDisplayName is "b" or "c" or "d" or...this actually does what one > expects. > > The question is...why/how can this happen? > > Any insight would be greatly appreciated and thanks in advance! > > -K > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:26am UTC](https://discuss.elastic.co/t/cant-find-a-value-that-is-the-letter-a-please-read/12816/4 "2017-07-06T02:26:02Z")