# Lucene syntax for match all docs **URL:** \ **Category:** Elasticsearch\ **Created:** [February 5, 2013, 9:53pm UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631 "2013-02-05T21:53:16Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![hanafy\_ash](https://avatars.discourse-cdn.com/v4/letter/h/ba8739/32.png) [@hanafy\_ash](https://discuss.elastic.co/u/hanafy_ash)\ **Post date:** [February 5, 2013, 9:53pm UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/1 "2013-02-05T21:53:16Z")
I believe the Lucene query parser translates the query "_:_" into a MatchAllDocsQuery, whereas our ES cluster is returning 0 documents for the query: { "query": { "query\_string": "_._" } } I know we can do: { "query": { "match\_all": { } } } But I would still like to understand what's happening. Can someone explain why the ES query parser is acting this way? Am I incorrect in my understanding of the behavior of the Lucene query parser? Thanks, - Ash -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 6, 2013, 6:13am UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/2 "2013-02-06T06:13:27Z")
Try: { "query": { "query\_string": "\*" } } -- David 馃槈 Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs Le 5 f茅vr. 2013 脿 22:53, [hanafy.ash@gmail.com](mailto:hanafy.ash@gmail.com) a 茅crit : I believe the Lucene query parser translates the query "_:_" into a MatchAllDocsQuery, whereas our ES cluster is returning 0 documents for the query: { "query": { "query\_string": "_._" } } I know we can do: { "query": { "match\_all": { } } } But I would still like to understand what's happening. Can someone explain why the ES query parser is acting this way? Am I incorrect in my understanding of the behavior of the Lucene query parser? Thanks, - Ash -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\ **Post date:** [February 6, 2013, 10:34am UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/3 "2013-02-06T10:34:03Z")
On Tue, 2013-02-05 at 13:53 -0800, [hanafy.ash@gmail.com](mailto:hanafy.ash@gmail.com) wrote: > I believe the Lucene query parser translates the query "_:_" into a > MatchAllDocsQuery, whereas our ES cluster is returning 0 documents for > the query: > > { "query": { "query\_string": "_._" } } You correctly specify the match-all query as '_:_' but then you test it as '_._' clint -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![hanafy\_ash](https://avatars.discourse-cdn.com/v4/letter/h/ba8739/32.png) [@hanafy\_ash](https://discuss.elastic.co/u/hanafy_ash)\ **Post date:** [February 6, 2013, 2:19pm UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/4 "2013-02-06T14:19:44Z")
Thanks for pointing out my typo Clinton. However, we were indeed using the "_:_" for the query: curl -X GET '[http://localhost:9200/documents/\_search?pretty](http://localhost:9200/documents/_search?pretty)' -d '{"query":{"query\_string":{"query":"_:_"}}}' { "took" : 9, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 0, "max\_score" : null, "hits" : } } However, the "_" query suggested by David does work as expected. But I still don't understand why that is the case? We currently have the \_all field enabled, and it is the default field for searching, but every field we index has in our mappings include\_in\_all: false (this is only temporary of course). So what does the query\_string '_' mean? And why doesn't "_:_" work as expected? On Wednesday, February 6, 2013 5:34:03 AM UTC-5, Clinton Gormley wrote: > On Tue, 2013-02-05 at 13:53 -0800, [hanaf...@gmail.com](mailto:hanaf...@gmail.com) \wrote: > > > I believe the Lucene query parser translates the query "_:_" into a > > MatchAllDocsQuery, whereas our ES cluster is returning 0 documents for > > the query: > > > > { "query": { "query\_string": "_._" } } > > You correctly specify the match-all query as '_:_' but then you test it > as '_._' > > clint -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 6, 2013, 2:22pm UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/5 "2013-02-06T14:22:58Z")
I think you can use a matchQuery with "_:_". I did not try myself but it should work, no? By default a QueryString search only on \_all special field. This field contain all your structured fields content. So \* means search anything on \_all field. Searching for fieldname:\* does not search in \_all field but in "fieldname". Does it help? -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr | @scrutmydocs Le 6 f茅vr. 2013 脿 15:19, [hanafy.ash@gmail.com](mailto:hanafy.ash@gmail.com) a 茅crit : > Thanks for pointing out my typo Clinton. However, we were indeed using the "_:_" for the query: > > curl -X GET '[http://localhost:9200/documents/\_search?pretty](http://localhost:9200/documents/_search?pretty)' -d '{"query":{"query\_string":{"query":"_:_"}}}' > { > "took" : 9, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 0, > "max\_score" : null, > "hits" : > } > } > > However, the "_" query suggested by David does work as expected. But I still don't understand why that is the case? We currently have the \_all field enabled, and it is the default field for searching, but every field we index has in our mappings include\_in\_all: false (this is only temporary of course). So what does the query\_string '_' mean? And why doesn't "_:_" work as expected? > > On Wednesday, February 6, 2013 5:34:03 AM UTC-5, Clinton Gormley wrote: > On Tue, 2013-02-05 at 13:53 -0800, [hanaf...@gmail.com](mailto:hanaf...@gmail.com) wrote: > > > I believe the Lucene query parser translates the query "_:_" into a > > MatchAllDocsQuery, whereas our ES cluster is returning 0 documents for > > the query: > > > > { "query": { "query\_string": "_._" } } > > You correctly specify the match-all query as '_:_' but then you test it > as '_._' > > clint > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\ **Post date:** [February 6, 2013, 2:38pm UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/6 "2013-02-06T14:38:52Z")
On Wed, 2013-02-06 at 06:19 -0800, [hanafy.ash@gmail.com](mailto:hanafy.ash@gmail.com) wrote: > Thanks for pointing out my typo Clinton. However, we were indeed > using the "_:_" for the query: > > curl -X GET '[http://localhost:9200/documents/\_search?pretty](http://localhost:9200/documents/_search?pretty)' -d > '{"query":{"query\_string":{"query":"_:_"}}}' what version of ES is this? When I look at the code in master, it has this in the query string wildcard parsing: ``` if (actualField == null) { return newMatchAllDocsQuery(); } if ("*".equals(actualField) || "_all".equals(actualField)) { return newMatchAllDocsQuery(); } ``` which means that \* \_all:\* and _:_ should all work Certainly that's the case when I test it out clint -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![hanafy\_ash](https://avatars.discourse-cdn.com/v4/letter/h/ba8739/32.png) [@hanafy\_ash](https://discuss.elastic.co/u/hanafy_ash)\ **Post date:** [February 6, 2013, 2:54pm UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/7 "2013-02-06T14:54:27Z")
We are using elasticsearch 0.20.1, were those code changes recent? '\_all:_' and '_' work, but not '_:_' Clinton, could you point me at where in the source you found the code that parses the query? Thanks again for the help. - Ash curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all](http://localhost:9200/documents/_search?pretty&fields=all)' -d '{"query":{"query\_string":{"query":"\*"}}}' { "took" : 10, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 2, "max\_score" : 1.0, "hits" : [ { "\_index" : "documents", "\_type" : "document", "\_id" : "blah", "\_score" : 1.0 }, { "\_index" : "documents", "\_type" : "document", "\_id" : "boom", "\_score" : 1.0 } ] } } curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all](http://localhost:9200/documents/_search?pretty&fields=all)' -d '{"query":{"query\_string":{"query":"\_all:\*"}}}' { "took" : 9, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 2, "max\_score" : 1.0, "hits" : [ { "\_index" : "documents", "\_type" : "document", "\_id" : "blah", "\_score" : 1.0 }, { "\_index" : "documents", "\_type" : "document", "\_id" : "boom", "\_score" : 1.0 } ] } } curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all](http://localhost:9200/documents/_search?pretty&fields=all)' -d '{"query":{"query\_string":{"query":"_:_"}}}' { "took" : 3, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 0, "max\_score" : null, "hits" : } } On Wednesday, February 6, 2013 9:38:52 AM UTC-5, Clinton Gormley wrote: > On Wed, 2013-02-06 at 06:19 -0800, [hanaf...@gmail.com](mailto:hanaf...@gmail.com) \wrote: > > > Thanks for pointing out my typo Clinton. However, we were indeed > > using the "_:_" for the query: > > > > curl -X GET '[http://localhost:9200/documents/\_search?pretty](http://localhost:9200/documents/_search?pretty)' -d > > '{"query":{"query\_string":{"query":"_:_"}}}' > > what version of ES is this? > > When I look at the code in master, it has this in the query string > wildcard parsing: > > ``` > if (actualField == null) { > return newMatchAllDocsQuery(); > } > if ("*".equals(actualField) || "_all".equals(actualField)) { > return newMatchAllDocsQuery(); > } > > ``` > > which means that \* \_all:\* and _:_ should all work > > Certainly that's the case when I test it out > > clint -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 6, 2013, 3:04pm UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/8 "2013-02-06T15:04:11Z")
It was fixed in 0.20.2. See [\*:\* query not working 路 Issue #2486 路 elastic/elasticsearch 路 GitHub](https://github.com/elasticsearch/elasticsearch/issues/2486) -- David Pilato | Technical Advocate | [Elasticsearch.com](http://Elasticsearch.com) @dadoonet | @elasticsearchfr | @scrutmydocs Le 6 f茅vr. 2013 脿 15:54, [hanafy.ash@gmail.com](mailto:hanafy.ash@gmail.com) a 茅crit : > We are using elasticsearch 0.20.1, were those code changes recent? > > '\_all:_' and '_' work, but not '_:_' > > Clinton, could you point me at where in the source you found the code that parses the query? Thanks again for the help. > > - Ash > > curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all](http://localhost:9200/documents/_search?pretty&fields=all)' -d '{"query":{"query\_string":{"query":"\*"}}}' > { > "took" : 10, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 2, > "max\_score" : 1.0, > "hits" : [ { > "\_index" : "documents", > "\_type" : "document", > "\_id" : "blah", > "\_score" : 1.0 > }, { > "\_index" : "documents", > "\_type" : "document", > "\_id" : "boom", > "\_score" : 1.0 > } ] > } > } > > curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all](http://localhost:9200/documents/_search?pretty&fields=all)' -d '{"query":{"query\_string":{"query":"\_all:\*"}}}' > { > "took" : 9, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 2, > "max\_score" : 1.0, > "hits" : [ { > "\_index" : "documents", > "\_type" : "document", > "\_id" : "blah", > "\_score" : 1.0 > }, { > "\_index" : "documents", > "\_type" : "document", > "\_id" : "boom", > "\_score" : 1.0 > } ] > } > } > > curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all](http://localhost:9200/documents/_search?pretty&fields=all)' -d '{"query":{"query\_string":{"query":"_:_"}}}' > { > "took" : 3, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 0, > "max\_score" : null, > "hits" : > } > } > > On Wednesday, February 6, 2013 9:38:52 AM UTC-5, Clinton Gormley wrote: > On Wed, 2013-02-06 at 06:19 -0800, [hanaf...@gmail.com](mailto:hanaf...@gmail.com) wrote: > > > Thanks for pointing out my typo Clinton. However, we were indeed > > using the "_:_" for the query: > > > > curl -X GET '[http://localhost:9200/documents/\_search?pretty](http://localhost:9200/documents/_search?pretty)' -d > > '{"query":{"query\_string":{"query":"_:_"}}}' > > what version of ES is this? > > When I look at the code in master, it has this in the query string > wildcard parsing: > > ``` > if (actualField == null) { > return newMatchAllDocsQuery(); > } > if ("*".equals(actualField) || "_all".equals(actualField)) { > return newMatchAllDocsQuery(); > } > > ``` > > which means that \* \_all:\* and _:_ should all work > > Certainly that's the case when I test it out > > clint > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![hanafy\_ash](https://avatars.discourse-cdn.com/v4/letter/h/ba8739/32.png) [@hanafy\_ash](https://discuss.elastic.co/u/hanafy_ash)\ **Post date:** [February 6, 2013, 3:15pm UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/9 "2013-02-06T15:15:03Z")
Thanks for the quick responses! We will update elasticsearch to \>= 0.20.2 and try this out - Ash On Wednesday, February 6, 2013 10:04:11 AM UTC-5, David Pilato wrote: > It was fixed in 0.20.2. See > [\*:\* query not working 路 Issue #2486 路 elastic/elasticsearch 路 GitHub](https://github.com/elasticsearch/elasticsearch/issues/2486) > > -- > _David Pilato_ | _Technical Advocate_ | _[Elasticsearch.com](http://Elasticsearch.com)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr[https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) > | @scrutmydocs [https://twitter.com/scrutmydocs](https://twitter.com/scrutmydocs) > > Le 6 f茅vr. 2013 脿 15:54, [hanaf...@gmail.com](mailto:hanaf...@gmail.com) \ a 茅crit : > > We are using elasticsearch 0.20.1, were those code changes recent? > > '\_all:_' and '_' work, but not '_:_' > > Clinton, could you point me at where in the source you found the code that > parses the query? Thanks again for the help. > > - Ash > > curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all'-d](http://localhost:9200/documents/_search?pretty&fields=all'-d) '{"query":{"query\_string":{"query":"\*"}}}' > > { > "took" : 10, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 2, > "max\_score" : 1.0, > "hits" : [ { > "\_index" : "documents", > "\_type" : "document", > "\_id" : "blah", > "\_score" : 1.0 > }, { > "\_index" : "documents", > "\_type" : "document", > "\_id" : "boom", > "\_score" : 1.0 > } ] > } > } > > curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all'-d](http://localhost:9200/documents/_search?pretty&fields=all'-d) '{"query":{"query\_string":{"query":"\_all:\*"}}}' > { > "took" : 9, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 2, > "max\_score" : 1.0, > "hits" : [ { > "\_index" : "documents", > "\_type" : "document", > "\_id" : "blah", > "\_score" : 1.0 > }, { > "\_index" : "documents", > "\_type" : "document", > "\_id" : "boom", > "\_score" : 1.0 > } ] > } > } > > curl -X GET '[http://localhost:9200/documents/\_search?pretty&fields=all'-d](http://localhost:9200/documents/_search?pretty&fields=all'-d) '{"query":{"query\_string":{"query":"_:_"}}}' > > { > "took" : 3, > "timed\_out" : false, > "\_shards" : { > "total" : 5, > "successful" : 5, > "failed" : 0 > }, > "hits" : { > "total" : 0, > "max\_score" : null, > "hits" : > } > } > > On Wednesday, February 6, 2013 9:38:52 AM UTC-5, Clinton Gormley wrote: > > > On Wed, 2013-02-06 at 06:19 -0800, [hanaf...@gmail.com](mailto:hanaf...@gmail.com) wrote: > > > > > Thanks for pointing out my typo Clinton. However, we were indeed > > > using the "_:_" for the query: > > > > > > curl -X GET '[http://localhost:9200/documents/\_search?pretty](http://localhost:9200/documents/_search?pretty)' -d > > > '{"query":{"query\_string":{"query":"_:_"}}}' > > > > what version of ES is this? > > > > When I look at the code in master, it has this in the query string > > wildcard parsing: > > > > ``` > > if (actualField == null) { > > return newMatchAllDocsQuery(); > > } > > if ("*".equals(actualField) || "_all".equals(actualField)) { > > return newMatchAllDocsQuery(); > > } > > > > ``` > > > > which means that \* \_all:\* and _:_ should all work > > > > Certainly that's the case when I test it out > > > > clint > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:52am UTC](https://discuss.elastic.co/t/lucene-syntax-for-match-all-docs/10631/10 "2017-07-06T02:52:45Z")