# Inconsistent results using Lucene Query Syntax

**URL:** <https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034>\
**Category:** Elasticsearch\
**Created:** [April 23, 2018, 5:45am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034 "2018-04-23T05:45:26Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![SRIpandu1729](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripandu1729/32/27368_2.png) [@SRIpandu1729](https://discuss.elastic.co/u/SRIpandu1729)\
**Post date:** [April 23, 2018, 5:45am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/1 "2018-04-23T05:45:27Z")

</div>

I am using elasticstack for log analysis. When I am querying from Kibana using the Lucene Query Syntax I am gettting some inconsistent results.

The queries along with their respective number of hits are:

clientIP: [66.249.64.\* TO 66.249.79._] --\> 18,853 hits  
  ![1](https://us1.discourse-cdn.com/elastic/original/3X/5/3/53409ebd427e1aebe7d289299c6bfd4e4dd5c32d.png)  
clientIP: [66.249.80._ TO 66.249.93.\*] --\> 39,630 hits  
 ![2](https://us1.discourse-cdn.com/elastic/original/3X/1/5/151d02a623696adf0aa0bda5382aa4f9f9c77440.png)

however  
clientIP: [66.249.64.\* TO 66.249.93.\*] --\> 92,045 hits  
 ![3](https://us1.discourse-cdn.com/elastic/original/3X/3/f/3f381f089e68aafd8e974a89b2f7d2f633274e7f.png)

Am I doing anything wrong here?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 23, 2018, 6:24am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/2 "2018-04-23T06:24:01Z")

</div>

What do you get if you try `clientIP: [66.249.64.0 TO 66.249.79.255]`, `clientIP: [66.249.80.0 TO 66.249.93.255]` and `clientIP: [66.249.64.0 TO 66.249.93.255]`?

---

<div class="post-metadata">

**Author:** ![SRIpandu1729](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripandu1729/32/27368_2.png) [@SRIpandu1729](https://discuss.elastic.co/u/SRIpandu1729)\
**Post date:** [April 23, 2018, 6:31am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/3 "2018-04-23T06:31:20Z")

</div>

The results seem to have changed but again the sum doesn't add up

![11](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9e6505224188e05bd9415acab1937c7cb3a90b38.png)

![22](https://us1.discourse-cdn.com/elastic/original/3X/5/1/51f67ac4b2b80b9f63163bf0018a2d959eaf2711.png)

![33](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30b3fe36f7616a3728ef099aefbef5519b243173.png)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 23, 2018, 6:32am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/4 "2018-04-23T06:32:31Z")

</div>

What is the mapping of the field?

---

<div class="post-metadata">

**Author:** ![SRIpandu1729](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripandu1729/32/27368_2.png) [@SRIpandu1729](https://discuss.elastic.co/u/SRIpandu1729)\
**Post date:** [April 23, 2018, 6:33am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/5 "2018-04-23T06:33:43Z")

</div>

The mapping I used is string

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 23, 2018, 6:38am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/6 "2018-04-23T06:38:57Z")

</div>

OK. That means that the IP format will not be enforced. What results do `clientIP: [66.249.79.255 TO 66.249.80.0]` and `clientIP: [66.249.64.0 TO 66.249.80.0]` give?

---

<div class="post-metadata">

**Author:** ![SRIpandu1729](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripandu1729/32/27368_2.png) [@SRIpandu1729](https://discuss.elastic.co/u/SRIpandu1729)\
**Post date:** [April 23, 2018, 6:42am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/7 "2018-04-23T06:42:34Z")

</div>

This happened

![111](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2abbd34522ab969bd41d9beeebf98ba2cc6d45b7.png)

![222](https://us1.discourse-cdn.com/elastic/original/3X/a/c/ac6db4a54d71d61e43977010c22e9f1b6ed1b3e8.png)

So does changing the mapping for this field fix this? If yes can you plase suggest how to? (becuase the data is already indexed or is it better to reindex the data?)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 23, 2018, 6:49am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/8 "2018-04-23T06:49:02Z")

</div>

As you are performing a range query you need to have the same start and end point when you split the interval up as the end value is not included (range is`[start <= value < end]`). `clientIP: [66.249.64.0 TO 66.249.80.0]` and `clientIP: [66.249.80.0 TO 66.249.94.0]` would therefore cover the full range.

If you want to instead map the field as `ip` you will need to reindex the data into a new index with the correct mapping.

---

<div class="post-metadata">

**Author:** ![SRIpandu1729](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripandu1729/32/27368_2.png) [@SRIpandu1729](https://discuss.elastic.co/u/SRIpandu1729)\
**Post date:** [April 23, 2018, 7:05am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/9 "2018-04-23T07:05:51Z")

</div>

Thank you very much @Christian_Dahlqvist

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2018, 7:05am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034/10 "2018-05-21T07:05:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.