# How to search punctuation in the discover page?

**URL:** <https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463>\
**Category:** Kibana\
**Created:** [February 26, 2018, 10:04am UTC](https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463 "2018-02-26T10:04:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![lin\_hiro](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@lin\_hiro](https://discuss.elastic.co/u/lin_hiro)\
**Post date:** [February 26, 2018, 10:04am UTC](https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463/1 "2018-02-26T10:04:13Z")

</div>

I search message:"\<-- 500"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02ffd739f0263c321d6d18f6cd8eda1433458beb.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/f/dfcc5b2c04c0b67e56aed5a41824cee3e2c52502.png)

if I want to search message:"\<-- " there is no result. I try message:"\<--", also no result.  
why??😥  
thanks.

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [February 27, 2018, 7:21pm UTC](https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463/2 "2018-02-27T19:21:37Z")

</div>

@tsullivan s going to take this one 🙂

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [February 27, 2018, 9:46pm UTC](https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463/3 "2018-02-27T21:46:11Z")

</div>

Hi!

Most likely this is a case where `<--` can't be searched because those characters aren't picked up by the analyzer that processes the message at index time. The `500` is tokenized, but the `<--` isn't.

Elasticsearch has an API to test the standard analyzer, which allows you to see the tokens that are found in a message. Try this in Console:

```auto
POST _analyze
{
  "analyzer": "standard",
  "text": "hello <-- 500"
}

```

The result looks something like this:

```auto
{
  "tokens": [
    {
      "token": "hello",
      "start_offset": 0,
      "end_offset": 5,
      "type": "<ALPHANUM>",
      "position": 0
    },
    {
      "token": "500",
      "start_offset": 10,
      "end_offset": 13,
      "type": "<NUM>",
      "position": 1
    }
  ]
}

```

There are a few options you have to enable this workflow, but the solutions will all be steps to take in the setup of this index.

One option is to create a template that applies to newly created indices in this pattern, and specify a custom analyzer, using a tokenizer that will recognize those characters as a token. The `whitespace` tokenizer will do that:

```auto
POST _analyze
{
  "analyzer": "whitespace",
  "text": "hello <-- 500"
}

```

Another option is to add a field that can be searched on, only for documents with a message that has those characters. In other words, you can create an ingest node pipeline with a grok pattern that looks for `<--` in incoming data. When it finds the match, it can add a field that will help you find all those documents in a search.

---

<div class="post-metadata">

**Author:** ![lin\_hiro](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@lin\_hiro](https://discuss.elastic.co/u/lin_hiro)\
**Post date:** [February 28, 2018, 4:00am UTC](https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463/4 "2018-02-28T04:00:15Z")

</div>

@tsullivan thanks very much, it's OK now.  
And Here's another question to ask, when I search in Dev Tools tab and set size:500

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a2b03ba33c86c483e1484e7460b59b36f37ff0e4.png)  
sometimes, the kibana will become Red,  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb72bfa79a7258596880a58183a01c9ecb277647.png)  
Is it due to timeout or too much cold data?  
thanks.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [February 28, 2018, 6:13am UTC](https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463/5 "2018-02-28T06:13:52Z")

</div>

If Kibana status is "red," it means that one or more of the plugins have a red status. You gave a cropped screenshot of the status page, but on that same page will be a table of all the plugins and their status. If any of them aren't green, there will be a status message that should have some helpful info.

---

<div class="post-metadata">

**Author:** ![lin\_hiro](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@lin\_hiro](https://discuss.elastic.co/u/lin_hiro)\
**Post date:** [February 28, 2018, 8:18am UTC](https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463/6 "2018-02-28T08:18:58Z")

</div>

thanks very much 😀

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2018, 8:19am UTC](https://discuss.elastic.co/t/how-to-search-punctuation-in-the-discover-page/121463/7 "2018-03-28T08:19:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.