# Is it possible to search or exclude something like a string "{}"?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465>\
**Category:** Kibana\
**Created:** [July 13, 2015, 5:12pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465 "2015-07-13T17:12:01Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mark\_Farina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_farina/32/3397_2.png) [@Mark\_Farina](https://discuss.elastic.co/u/Mark_Farina)\
**Post date:** [July 13, 2015, 5:12pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/1 "2015-07-13T17:12:02Z")

</div>

I can't seem to filter on records that contain nothing more than {} in a text field. I've tried all kinds of queries such as the ["{}" TO \*] syntax, and even simple NOT property:"{}". Nothing seems to work. I've attached a picture of the data field so that it's clear what I'm trying to isolate.

![](https://us1.discourse-cdn.com/elastic/original/2X/2/203d7188aafa15154a2ea5dd39cec28e239a9614.JPG)

---

<div class="post-metadata">

**Author:** ![asafyigal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asafyigal/32/685_2.png) [@asafyigal](https://discuss.elastic.co/u/asafyigal)\
**Post date:** [July 14, 2015, 8:55am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/2 "2015-07-14T08:55:57Z")

</div>

try -property:"{}"

-- Asaf.

---

<div class="post-metadata">

**Author:** ![Mark\_Farina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_farina/32/3397_2.png) [@Mark\_Farina](https://discuss.elastic.co/u/Mark_Farina)\
**Post date:** [July 14, 2015, 7:58pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/3 "2015-07-14T19:58:37Z")

</div>

As I mentioned above, I've tested this: -other.finesse.errorInfo.eventDetails.ERROR:"{}". That has no impact on the search :(.

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [July 14, 2015, 9:58pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/4 "2015-07-14T21:58:38Z")

</div>

{} are special characters in Lucene query syntax, so you have to [escape](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html#Escaping%20Special%20Characters) them.

---

<div class="post-metadata">

**Author:** ![Mark\_Farina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_farina/32/3397_2.png) [@Mark\_Farina](https://discuss.elastic.co/u/Mark_Farina)\
**Post date:** [July 14, 2015, 10:01pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/5 "2015-07-14T22:01:30Z")

</div>

I should have mentioned I tried this: -other.finesse.errorInfo.eventDetails.ERROR:"\{\}". That also doesn't remove these records from the search :(.

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [July 16, 2015, 2:19am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/6 "2015-07-16T02:19:44Z")

</div>

Mark - I can reproduce the behavior you describe. I indexed a couple of sample documents with string fields mapped to '{}' and I also cannot do a search for them using **field\_name:"{}"**.

As it turns out that, the standard Elasticsearch analyzer drops these characters. You can ascertain this using the following query against your cluster:  
`
curl -XGET 'localhost:9200/_analyze?analyzer=standard&pretty' -d '{}'
{
"tokens" : []
}
`  
How are indexing this data? Is there an option to use another analyzer, e.g. whitespace?

---

<div class="post-metadata">

**Author:** ![Mark\_Farina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_farina/32/3397_2.png) [@Mark\_Farina](https://discuss.elastic.co/u/Mark_Farina)\
**Post date:** [July 16, 2015, 8:29pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/7 "2015-07-16T20:29:37Z")

</div>

That's a great question, let me get back to you! Thank you for your help.

---

<div class="post-metadata">

**Author:** ![Mark\_Farina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_farina/32/3397_2.png) [@Mark\_Farina](https://discuss.elastic.co/u/Mark_Farina)\
**Post date:** [July 17, 2015, 8:52pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/8 "2015-07-17T20:52:48Z")

</div>

OK, so we're using the standard analyzer with the dynamic mappings being created by Logstash. It looks like this:

```
eventDetails: {
  properties: {
    ERROR: {
      type: "string",
        norms: {
          enabled: false
        },
     fields: {
        raw: {
          type: "string",
          index: "not_analyzed",
          ignore_above: 256
        }
     }
  },
```

---

<div class="post-metadata">

**Author:** ![Mark\_Farina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_farina/32/3397_2.png) [@Mark\_Farina](https://discuss.elastic.co/u/Mark_Farina)\
**Post date:** [July 29, 2015, 8:38pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/9 "2015-07-29T20:38:07Z")

</div>

I'm shocked that there is no way to search for strings containing special characters like this :(.

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [July 30, 2015, 4:37am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/10 "2015-07-30T04:37:50Z")

</div>

There should be if you switch to using another analyzer, such as "whitespace". Have you tried that?

---

<div class="post-metadata">

**Author:** ![Mark\_Farina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_farina/32/3397_2.png) [@Mark\_Farina](https://discuss.elastic.co/u/Mark_Farina)\
**Post date:** [July 30, 2015, 4:39pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/11 "2015-07-30T16:39:29Z")

</div>

I'm not certain how to do that, I'll do some research today. Thank you for clarifying your original answer :).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:15pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-or-exclude-something-like-a-string/25465/12 "2017-07-06T14:15:33Z")

</div>