# Kibana search based on Lucene Query Parser Syntax

**URL:** <https://discuss.elastic.co/t/kibana-search-based-on-lucene-query-parser-syntax/54298>\
**Category:** Kibana\
**Created:** [June 29, 2016, 2:53pm UTC](https://discuss.elastic.co/t/kibana-search-based-on-lucene-query-parser-syntax/54298 "2016-06-29T14:53:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Post date:** [June 29, 2016, 2:53pm UTC](https://discuss.elastic.co/t/kibana-search-based-on-lucene-query-parser-syntax/54298/1 "2016-06-29T14:53:38Z")

</div>

hi all,

I try to understand better the behavior of a lucene search through kibana.

I'm aware about analyzer, tokenizer, filter ...

**An exemple:**

I have a field "test" and I look for "toto-tata.test.ok" value.

- If I do test:toto-tata.test.ok I don't get the result as expected.
- If I do test:"toto-tata.test.ok" I get the result as expected.

I know in lucene, "toto-tata.test.ok" is a Phrase.

So what represents toto-tata.test.ok without quote for lucene ? How kibana make the search on the field "test" when there is no quote for the search value ?

For information, my metafield \_all is disable. I have a default field, it is not the "test" field.

Thanks in advance.  
Alex

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [June 29, 2016, 11:21pm UTC](https://discuss.elastic.co/t/kibana-search-based-on-lucene-query-parser-syntax/54298/2 "2016-06-29T23:21:13Z")

</div>

Great question. I've seen this happen before as well, but I never really understood what was happening, so now I had a real reason to look it up 😄.

When you put something like that in the query bar in Kibana, it passes the contents through to Elasticsearch as the `query` parameter in a `query_sting` query. Here's a quick example from the relevant part of the request sent to Elasticsearch, when using `clientip:"186.187.11.181"` in the query bar:

```auto
"query": {
        "bool": {
            "must": [{
                "query_string": {
                    "query": "clientip:\"186.187.11.181\"",
                    "analyze_wildcard": true
                }
            }, {
                "range": {
                    "@timestamp": {
                        "gte": 1467240398565,
                        "lte": 1467241298565,
                        "format": "epoch_millis"
                    }
                }
            }],
            "must_not": []
        }
    },

```

Drop the quotes and the query becomes:

```auto
"query": {
        "bool": {
            "must": [{
                "query_string": {
                    "query": "clientip:186.187.11.181",
                    "analyze_wildcard": true
                }
            }, {
                "range": {
                    "@timestamp": {
                        "gte": 1467240403856,
                        "lte": 1467241303857,
                        "format": "epoch_millis"
                    }
                }
            }],
            "must_not": []
        }
    },

```

I'm still not entirely sure how the two queries differ, but perhaps it has to fo with the `"analyze_wildcard": true` specified. [According to the docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html), "by setting analyze\_wildcard to true, an attempt will be made to analyze wildcarded words before searching the term list for matching terms." So, it's possible that the the analyzer is changing the query, and thus affecting the results.

That's not really an answer, I know, but that's as far as I've been able to get with it. In the query string syntax section of the docs, it links back to itself. I'd recommend asking in the Elasticsearch section of the forums, someone over there likely has a better understanding of the query syntax.

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [June 29, 2016, 11:24pm UTC](https://discuss.elastic.co/t/kibana-search-based-on-lucene-query-parser-syntax/54298/3 "2016-06-29T23:24:52Z")

</div>

You know, I bet it has to do with the `-` in the query. The dash is a [reserved character](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_reserved_characters), so if you don't quote the value or escape that character, it's probably not querying like you think it is. I'm not sure what the `-` means in the query syntax though...

EDIT: Ah, the `-` apparently [negates a single token](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-simple-query-string-query.html#_simple_query_string_syntax), which perhaps means that query is looking for `toto*.test.ok`, where the `*` is anything but _tata_?

---

<div class="post-metadata">

**Author:** ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Post date:** [June 30, 2016, 10:20am UTC](https://discuss.elastic.co/t/kibana-search-based-on-lucene-query-parser-syntax/54298/4 "2016-06-30T10:20:09Z")

</div>

Hi,

Thanks a lot for your answer, I think you're right, I need to post in Elasticsearch section.

Regarding the "-" character, I made some tests and it negates a single token if you have a space before the "-" in my point of view.

Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/kibana-search-based-on-lucene-query-parser-syntax/54298/5 "2017-07-06T13:48:39Z")

</div>