# Lucene query syntax won't work

**URL:** <https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828>\
**Category:** Elasticsearch\
**Created:** [February 10, 2022, 9:55am UTC](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828 "2022-02-10T09:55:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Martin\_Miloshev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martin_miloshev/32/99030_2.png) [@Martin\_Miloshev](https://discuss.elastic.co/u/Martin_Miloshev)\
**Post date:** [February 10, 2022, 9:55am UTC](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828/1 "2022-02-10T09:55:20Z")

</div>

Hi guys!  
I am trying to specify a table which I want to meet an amount of logs of three fields.

for example:

_metadata.environment: "prod" and metadata.component: "my-services" and level:"ERROR"_

Unfortunately, i get no results.  
If i remove the level field it wil be fine... but I want exactly to find the error logs in this component and this environment.

In the discover tab i get:

## Expand your time range

_One or more of the indices you’re looking at contains a date field. Your query may not match anything in the current time range, or there may not be any data at all in the currently selected time range. You can try changing the time range to one which contains data._

Any help will be appreciated, thanks!

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 17, 2022, 8:45am UTC](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828/2 "2022-02-17T08:45:50Z")

</div>

Hey Martin,

the only explanation without seeing any more details to me is that a field has beeb specified wrong - i.e. `level` instead of `log.level` - or that one field is not made searchable.

Do you care do share more details like a sample document along with the mapping, so that you could provide a fully reproducible example to test out and figure out what is wrong?

Thanks!

--Alex

---

<div class="post-metadata">

**Author:** ![Martin\_Miloshev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martin_miloshev/32/99030_2.png) [@Martin\_Miloshev](https://discuss.elastic.co/u/Martin_Miloshev)\
**Post date:** [February 17, 2022, 9:00am UTC](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828/3 "2022-02-17T09:00:21Z")

</div>

Thanks, Alexander!

I found the issue that if you specify the "and" keyword with lower case it is not working.  
should be like:  
_metadata.environment: "prod" AND metadata.component: "my-services" AND level:"ERROR"_

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2022, 9:00am UTC](https://discuss.elastic.co/t/lucene-query-syntax-wont-work/296828/4 "2022-03-17T09:00:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.