# Query Lucene on Kibana Discover not working as intended? **URL:** \ **Category:** Kibana\ **Created:** [March 20, 2019, 2:37pm UTC](https://discuss.elastic.co/t/query-lucene-on-kibana-discover-not-working-as-intended/173170 "2019-03-20T14:37:12Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![soufian.eldouqe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/soufian.eldouqe/32/42261_2.png) [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)\ **Post date:** [March 20, 2019, 2:37pm UTC](https://discuss.elastic.co/t/query-lucene-on-kibana-discover-not-working-as-intended/173170/1 "2019-03-20T14:37:12Z")
Hello, I I'm trying to search servers names on "host" attribut on my logstash index I'm searching on the Discover tab in Kibana. When I tape **sl00pm** in the search bar I got No results found and when I add " \* " and search for **sl00pm** \* I got this : ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a6e3d296df73492ba68d6173a745d40025ded790.png) I don't understand why. But when I do the same manip on another server name **slzq85** I got this : ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8e45a4f6bdb75edf93d3420e90a204f0a8454e8.png) And this is what I'm expecting. Here is the definition of my Index on LogStash : { "logstash-2019.03.20": { "aliases": {}, "mappings": { "apache-access": { "\_all": { "enabled": true, "norms": false }, "dynamic\_templates": [ { "message\_field": { "match": "message", "match\_mapping\_type": "string", "mapping": { "index": "analyzed", "omit\_norms": true, "type": "string" } } }, { "string\_fields": { "match": "\*", "match\_mapping\_type": "string", "mapping": { "fields": { "raw": { "ignore\_above": 256, "index": "not\_analyzed", "type": "string" } }, "index": "analyzed", "omit\_norms": true, "type": "string" } } } ], "properties": { "@timestamp": { "type": "date" }, "@version": { "type": "keyword" }, "date": { "type": "text", "norms": false, "fields": { "raw": { "type": "keyword", "ignore\_above": 256 } } }, "host": { "type": "text", "norms": false, "fields": { "raw": { "type": "keyword", "ignore\_above": 256 } } } } }, }, "settings": { "index": { "refresh\_interval": "5s", "number\_of\_shards": "5", "provided\_name": "logstash-2019.03.20", "creation\_date": "1553036402235", "number\_of\_replicas": "1", "uuid": "mCSFLYGETPm6qbgOwShHog", "version": { "created": "5060399" } } } } } And the version : version": { "number": "5.6.3", "lucene\_version": "6.6.1" }, Could you please tell me why my results aren't good? I want to add that I'am using mapping types and having the same attribut in different mapping types of my Index but with the same definition as above regards ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [March 20, 2019, 4:57pm UTC](https://discuss.elastic.co/t/query-lucene-on-kibana-discover-not-working-as-intended/173170/2 "2019-03-20T16:57:53Z")
Hmm, that is indeed strange. Have you tried doing something like `host: s100pm`? If so, do you get the same result? ---
**Author:** ![soufian.eldouqe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/soufian.eldouqe/32/42261_2.png) [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)\ **Post date:** [March 21, 2019, 8:13am UTC](https://discuss.elastic.co/t/query-lucene-on-kibana-discover-not-working-as-intended/173170/3 "2019-03-21T08:13:39Z")
Thank you for your answer I tried this but I'm still having the same results. ---
**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\ **Post date:** [March 22, 2019, 10:19pm UTC](https://discuss.elastic.co/t/query-lucene-on-kibana-discover-not-working-as-intended/173170/4 "2019-03-22T22:19:35Z")
Hmm, in looking at the standard analyzer, it looks like for some reason `sl00pm.sii24` gets analyzed as a single token whereas `slzq85.sii24` gets analyzed as two separate tokens. You can use the Elasticsearch analyze API to verify this: ```auto GET _analyze { "analyzer" : "standard", "text" : "sl00pm.sii24.po10" } // results in { "tokens" : [ { "token" : "sl00pm.sii24", "start_offset" : 0, "end_offset" : 12, "type" : "", "position" : 0 }, { "token" : "po10", "start_offset" : 13, "end_offset" : 17, "type" : "", "position" : 1 } ] } ``` whereas ```auto GET _analyze { "analyzer" : "standard", "text" : "slzq85.sii24.po10" } // results in { "tokens" : [ { "token" : "slzq85", "start_offset" : 0, "end_offset" : 6, "type" : "", "position" : 0 }, { "token" : "sii24", "start_offset" : 7, "end_offset" : 12, "type" : "", "position" : 1 }, { "token" : "po10", "start_offset" : 13, "end_offset" : 17, "type" : "", "position" : 2 } ] } ``` ---
**Author:** ![soufian.eldouqe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/soufian.eldouqe/32/42261_2.png) [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)\ **Post date:** [March 25, 2019, 8:49am UTC](https://discuss.elastic.co/t/query-lucene-on-kibana-discover-not-working-as-intended/173170/5 "2019-03-25T08:49:22Z")
Yes I have the same results here : `sl00pm.sii24` gets analyzed as a single token whereas `slzq85.sii24` gets analyzed as two separate tokens. Do you have any idea why? ---
**Author:** ![soufian.eldouqe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/soufian.eldouqe/32/42261_2.png) [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)\ **Post date:** [March 25, 2019, 10:34am UTC](https://discuss.elastic.co/t/query-lucene-on-kibana-discover-not-working-as-intended/173170/6 "2019-03-25T10:34:13Z")
I have posted my question in other blogs and I got a logical answer : " The reason for that behavior is where the analyzer breaks words. The standard analyzer breaks words according to the rules laid out in [UAX #29](http://unicode.org/reports/tr29/#Word_Boundaries). Rules WB6 and WB11, in particular, are the ones to take note of here. Basically, it will not break on a letters with a '.' in the middle (ex: "ab.cd"), or on numbers with a '.' in the middle (ex: "12.34"), but it will break on numbers and letters separated by a '.' (ex: "12.cd"). So in your index, "sl00pm.soo85" is indexed as a single token, but "slzq85.soo85" is separated into two tokens: "slz85" and "soo85". The standard analyzer is designed to work best on text. Words and sentences. For an identifier like you are looking at, you might try a different analyzer, perhaps [PatternAnalyzer](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-pattern-analyzer.html)." Thank you very much Lukas for your answers ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 22, 2019, 10:34am UTC](https://discuss.elastic.co/t/query-lucene-on-kibana-discover-not-working-as-intended/173170/7 "2019-04-22T10:34:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.