# Kibana Lucene query string does not match the result

**URL:** <https://discuss.elastic.co/t/kibana-lucene-query-string-does-not-match-the-result/340703>\
**Category:** Elasticsearch\
**Created:** [August 13, 2023, 2:22pm UTC](https://discuss.elastic.co/t/kibana-lucene-query-string-does-not-match-the-result/340703 "2023-08-13T14:22:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [August 13, 2023, 2:22pm UTC](https://discuss.elastic.co/t/kibana-lucene-query-string-does-not-match-the-result/340703/1 "2023-08-13T14:22:23Z")

</div>

Kibana Lucene query string:  
`host:*AGC* AND NOT host:*LGAGC* AND NOT host:*AP* AND message:"\:ORA\-" AND NOT message:"ReconnectableOraErrCodes"`  
However, the query result not 100% match, such the pattern below in document will be returned  
`kQJkQJH+oRA/PDS`  
reference: [Lucene query strings](https://developer.newswhip.com/docs/lucene-query-strings)  
Thank you in advance 🙂

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [August 17, 2023, 6:08am UTC](https://discuss.elastic.co/t/kibana-lucene-query-string-does-not-match-the-result/340703/2 "2023-08-17T06:08:33Z")

</div>

Is there anyone has some idea~?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 17, 2023, 6:18am UTC](https://discuss.elastic.co/t/kibana-lucene-query-string-does-not-match-the-result/340703/3 "2023-08-17T06:18:16Z")

</div>

Please provide full mappings for the index as well as sample documents that are or are not returned by the query incorrectly. This way someone can reproduce the issue locally and provide insight.

Although it may not necessarily matter here it also always help to state which version of Elasticsearch and Kibana you are using.

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [August 18, 2023, 5:34am UTC](https://discuss.elastic.co/t/kibana-lucene-query-string-does-not-match-the-result/340703/4 "2023-08-18T05:34:38Z")

</div>

doc message:  
`223827 controlRuleXML: <Script Type="XML" Version="2023.327.0" FilterString="">H4sIAAAAAAAAAO1daW/jOLQJkQJH+oRA/PDS6LVWIDzm3GnW/DpvCPYlu`  
mapping:

```auto
"message_field": {
            "path_match": "message",
            "match_mapping_type": "string",
            "mapping": {
              "norms": false,
              "type": "text"
}

```

Kibana & Elasticsearch Version: 7.17.2

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 18, 2023, 6:17am UTC](https://discuss.elastic.co/t/kibana-lucene-query-string-does-not-match-the-result/340703/5 "2023-08-18T06:17:35Z")

</div>

The field you are searching is indexed as text, which means it is analysed using the standrard analyser. The analysis is done at both query and index time, so you can use the [analyze API](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/indices-analyze.html) to find out how the queries and indexed string are tokenized.

If you analyze the message as follows:

```auto
GET /_analyze
{
  "analyzer" : "standard",
  "text" : """223827 controlRuleXML: <Script Type="XML" Version="2023.327.0" FilterString="">H4sIAAAAAAAAAO1daW/jOLQJkQJH+oRA/PDS6LVWIDzm3GnW/DpvCPYlu"""
}

```

you can see it generates the following token:

```auto
{
      "token" : "ora",
      "start_offset" : 108,
      "end_offset" : 111,
      "type" : "<ALPHANUM>",
      "position" : 10
},

```

When you run the query, the query string will also be tokenized using the standard analyzer. If you analyse the query string as follows

```auto
GET /_analyze
{
  "analyzer" : "standard",
  "text" : "\\:ORA\\-"
}

```

you can see that this also results in an "ora" token, which results in a match

```auto
{
      "token" : "ora",
      "start_offset" : 2,
      "end_offset" : 5,
      "type" : "<ALPHANUM>",
      "position" : 0
}

```

I believe this is why you get a match.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2023, 6:17am UTC](https://discuss.elastic.co/t/kibana-lucene-query-string-does-not-match-the-result/340703/6 "2023-09-15T06:17:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.