# Missing result when it terms contained dash

**URL:** <https://discuss.elastic.co/t/missing-result-when-it-terms-contained-dash/11446>\
**Category:** Elasticsearch\
**Created:** [April 4, 2013, 8:20am UTC](https://discuss.elastic.co/t/missing-result-when-it-terms-contained-dash/11446 "2013-04-04T08:20:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Qing\_Guan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qing_guan/32/2405_2.png) [@Qing\_Guan](https://discuss.elastic.co/u/Qing_Guan)\
**Post date:** [April 4, 2013, 8:20am UTC](https://discuss.elastic.co/t/missing-result-when-it-terms-contained-dash/11446/1 "2013-04-04T08:20:42Z")

</div>

I build a log server that store my logs in elasticsearch.

Every log object looks like this

Log  
=============================================\>  
{ "space": "admin", "type": "error", "source": "lorem-aws", "message":  
"lorem error", "timestamp": 1365061457090 }  
\<=============================================

Then I use this query to fetch logs based on some parameters.  
Query  
=============================================\>  
{  
"query": {  
"filtered": {  
"filter": {  
"and": [  
{  
"terms": {  
"type": [  
"error",  
"notification",  
"warning"  
]  
}  
},  
{  
"terms": {  
"source": [  
"lorem-aws"  
]  
}  
}  
]  
},  
"query": {  
"bool": {  
"must": [  
{  
"field": {  
"space": "admin"  
}  
},  
{  
"query\_string": {  
"query": "\*",  
"default\_field": "message"  
}  
}  
]  
}  
}  
}  
},  
"sort": [  
{  
"timestamp": {  
"order": "desc"  
}  
}  
],  
"size": 10,  
"facets": {}  
}  
\<=============================================

I found out that the return results of above query was missing all the log  
which its source is exactly "lorem-aws".

But if I changed the terms of 'source` to ["lorem", "aws"], it can return  
all the logs that its source contain either "lorem" or "aws",  
but this is not what I want.

Am I doing something wrong? If so, how can I improve it?

Thanks

--kuno

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![mvg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mvg/32/98890_2.png) [@mvg](https://discuss.elastic.co/u/mvg)\
**Post date:** [April 4, 2013, 10:45am UTC](https://discuss.elastic.co/t/missing-result-when-it-terms-contained-dash/11446/2 "2013-04-04T10:45:31Z")

</div>

The `terms` filter that contains "lorem-aws" doesn't analyze at query time.  
So you search for `lorem-aws`  
During indexing the field `source` is analyzed, so the tokens that end up  
in the index are: `lorem` and `aws` (assuming you're using the default  
analyzer). This results in the fact that the document isn't found. Tho fix  
this you can do 2 things:

1. In your mapping set the `index` option for field `source` to  
`not_analyzed`. This makes sure that `lorem-aws` is indexed as is and you  
will have a match on it when using the `terms` filter. Note: changing the  
`index` option of a field can only be done for new fields and requires  
re-indexing.
2. Or replace the terms for the source field by a match query with  
`operator` set to `and` and wrap that in a query filter. Then at query time  
`lorem-aws` is expended to `lorem` and `aws` and therefor will match with  
the indexed tokens.

On 4 April 2013 10:20, Qing Guan [neokuno@gmail.com](mailto:neokuno@gmail.com) wrote:

> I build a log server that store my logs in elasticsearch.
> 
> Every log object looks like this
> 
> Log  
> =============================================\>  
> { "space": "admin", "type": "error", "source": "lorem-aws", "message":  
> "lorem error", "timestamp": 1365061457090 }  
> \<=============================================
> 
> Then I use this query to fetch logs based on some parameters.  
> Query  
> =============================================\>  
> {  
> "query": {  
> "filtered": {  
> "filter": {  
> "and": [  
> {  
> "terms": {  
> "type": [  
> "error",  
> "notification",  
> "warning"  
> ]  
> }  
> },  
> {  
> "terms": {  
> "source": [  
> "lorem-aws"  
> ]  
> }  
> }  
> ]  
> },  
> "query": {  
> "bool": {  
> "must": [  
> {  
> "field": {  
> "space": "admin"  
> }  
> },  
> {  
> "query\_string": {  
> "query": "\*",  
> "default\_field": "message"  
> }  
> }  
> ]  
> }  
> }  
> }  
> },  
> "sort": [  
> {  
> "timestamp": {  
> "order": "desc"  
> }  
> }  
> ],  
> "size": 10,  
> "facets": {}  
> }  
> \<=============================================
> 
> I found out that the return results of above query was missing all the log  
> which its source is exactly "lorem-aws".
> 
> But if I changed the terms of 'source` to ["lorem", "aws"], it can return  
> all the logs that its source contain either "lorem" or "aws",  
> but this is not what I want.
> 
> Am I doing something wrong? If so, how can I improve it?
> 
> Thanks
> 
> --kuno
> 
> --  
> You received this message because you are subscribed to the Google Groups  
> "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an  
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

--  
Met vriendelijke groet,

Martijn van Groningen

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:42am UTC](https://discuss.elastic.co/t/missing-result-when-it-terms-contained-dash/11446/3 "2017-07-06T02:42:48Z")

</div>