# Issue with elasticsearch query - dot in field values

**URL:** <https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943>\
**Category:** Elasticsearch\
**Created:** [February 20, 2021, 9:36am UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943 "2021-02-20T09:36:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sampson\_Light](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sampson_light/32/77283_2.png) [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\
**Post date:** [February 20, 2021, 9:36am UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943/1 "2021-02-20T09:36:23Z")

</div>

Hello,

There's an issue with the use of . in my field value.

The sample below is a 'valid' query that returns some hits

Copy to clipboard

```auto
{
  "query": {
    "bool": {
      "must": [
        {
          "wildcard": {
            "Address": "abcdef*"
          }
        },
        {
          "match": {
            "Message.Code": "AA101"
          }
        },
        {
          "range": {
            "DateCreated": {
              "gte": "2020-01-04",
              "lte": "2020-01-04"
            }
          }
        }
      ],
      "must_not": [],
      "should": []
    }
  }
}

```

However, the problem starts when I change Message.Code from "AA101" to "AA101.extra", resulting in 0 hits.

Copy to clipboard

```auto
{
  "query": {
    "bool": {
      "must": [
        {
          "wildcard": {
            "Address": "abcdef*"
          }
        },
        {
          "match": {
            "Message.Code": "AA101.extra"
          }
        },
        {
          "range": {
            "DateCreated": {
              "gte": "2020-01-04",
              "lte": "2020-01-04"
            }
          }
        }
      ],
      "must_not": [],
      "should": []
    }
  }
}

```

Please advise how I should go about this.

Thanks!  
Sam

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 20, 2021, 4:09pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943/2 "2021-02-20T16:09:36Z")

</div>

Can you provide sample data and the associated mapping?

---

<div class="post-metadata">

**Author:** ![Sampson\_Light](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sampson_light/32/77283_2.png) [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\
**Post date:** [February 20, 2021, 4:32pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943/3 "2021-02-20T16:32:43Z")

</div>

Hello Aaron,

I am unsure what do you mean by a sample data and the associated mapping.

The issue i'm facing is that inside my index, I have a field name Message.Code.

Within the Message.Code field, it contains 4 types of values:  
AA101, AA101.extra, AA200 & AA999.

When I run a simple count query for each of these 4 values, only AA101.extra returns nothing \> probably due to the dot annotation used.

Do you know if elasticsearch has some kind of limitation for dots?

Regards  
Sam

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 20, 2021, 4:42pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943/4 "2021-02-20T16:42:47Z")

</div>

I tested this and it seems to work correctly so would possibly lead to the other parts of the query?

Mapping

```auto
{
"type" : "text",
"fields" : {
"keyword" : {
 "type" : "keyword",
 "ignore_above" : 256
 }
}

```

```auto
POST test/_doc
{
  "Message.Code": "AA101"
}

POST test/_doc
{
  "Message.Code": "AA101.extra"
}

GET test/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "Message.Code": "AA101.extra"
          }
        }
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Sampson\_Light](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sampson_light/32/77283_2.png) [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\
**Post date:** [February 20, 2021, 5:09pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943/5 "2021-02-20T17:09:00Z")

</div>

> [@aaron-nimocks](#):
>
> ```auto
> {
> "type" : "text",
> "fields" : {
> "keyword" : {
> "type" : "keyword",
> "ignore_above" : 256
> }
> }
> 
> ```

The "type" I am using is \_doc rather than "text".

I just tried it again, somehow its working this time round, just for clarification, it doesn't matter what "type" I am using right?

Thanks  
Sam

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [February 20, 2021, 5:11pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943/6 "2021-02-20T17:11:45Z")

</div>

I don't think the type would have mattered since you should get results if it was a `text` or `keyword` type. Glad it's working now. 🙂

Text is for being able to search within the data.

Keyword is used for exact matches and searching is not allowed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2021, 5:12pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943/7 "2021-03-20T17:12:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.