# Query string containing the "/" (forward slash) raises the error "Cannot parse ... Encountered: \<EOF\>"

**URL:** <https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 6, 2020, 8:24am UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645 "2020-04-06T08:24:44Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 6, 2020, 8:24am UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/1 "2020-04-06T08:24:44Z")

</div>

Hi, I'm encountering the above-mentioned error when I'm searching for a document using:

```auto
"query_string": {
    "default_field": "innerId.txt",
    "query": "XMT01/195077567"
}

```

I'm getting the parse exception error "Cannot parse 'XMT01/195077567': Lexical error at line 1, column 18. Encountered: after : "/195077567".  
I've google-it and found out this to be reported previously and suggested by many that one must escape the slash. But this doesn't work for me. If I query for `"XMT01\\/195077567"` then I get back all the document which innerId field starts with `'XMT01'` and that's not right. I need only one document with that exact value.  
Furthermore, I need to use the `query_string` because of all this is nested in a watcher with chain input. The first search gets all the documents that satisfy search criteria, then a lookup extracts all the values that would be used for querying in the next search and put them in a HashSet and finally, the last search is using the above query string for getting the related documents. Obviously, there can be more than one document that we are searching the matching document for.  
Here is the simplified code extracted for my watcher:

```auto
  "input": {
    "chain": {
      "inputs": [
        {
          "first": {
			/* search for documents that match criteria*/
          }
        },
        {
          "inners_lookup": {
            "transform": {
              "script": {
                "lang": "painless",
                "source": """
                  HashSet inners = new HashSet();
                  for (hit in ctx.payload.first.hits.hits) inners.add(hit._source.extInnerId);
                  return ['innersA' : inners];
                """
              }
            }
          }
        },
        {
          "inners": {
		    /* ... */
			{
			  "query_string": {
				"default_field": "innerId.txt",
				"query": "{{#ctx.payload.inners_lookup.innersA}}'{{.}}' {{/ctx.payload.inners_lookup.innersA}}"
			  }
			}
          }
        }
	  ]
    }
  }

```

P.S.  
I'm on Elasticsaerch version 7.4.2

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 6, 2020, 1:21pm UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/2 "2020-04-06T13:21:45Z")

</div>

can you provide a **full** reproduction instead of just snippets, so one can reproduce this locally?

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 6, 2020, 2:05pm UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/3 "2020-04-06T14:05:43Z")

</div>

Hi and thx for your replay.  
Here is the body of my search request:

```auto
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "status": 0
          }
        },
        {
          "term": {
            "transactionType": 3
          }
        },
        {
          "range": {
            "eventTime": {
              "gte": "now-24h"
            }
          }
        },
        {
          "query_string": {
            "default_field": "innerId.txt",
            "query": "XMT01/195077567"
            }
        }
      ]
    }
  }
}

```

And here is the error I'm recieving

```auto
{
  "took" : 1827,
  "timed_out" : false,
  "_shards" : {
    "total" : 56,
    "successful" : 54,
    "skipped" : 0,
    "failed" : 2,
    "failures" : [
      {
        "shard" : 0,
        "index" : ,
        "node" : "Q13JAbZsQL6t9EO_Ef0Xkg",
        "reason" : {
          "type" : "query_shard_exception",
          "reason" : "Failed to parse query [XMT01/195077567]",
          "index_uuid" : "7u1F5GMwTl6ZzFncdowuFA",
          "index" : ,
          "caused_by" : {
            "type" : "parse_exception",
            "reason" : """Cannot parse 'XMT01/195077567': Lexical error at line 1, column 18. Encountered: <EOF> after : "/195077567"""",
            "caused_by" : {
              "type" : "token_mgr_error",
              "reason" : """Lexical error at line 1, column 18. Encountered: <EOF> after : "/195077567""""
            }
          }
        }
      }
    ]
  },
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : []
  }
}

```

I've deleted the index name (I'm being paranoid here 😉 )

Hope this helps!

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 6, 2020, 2:12pm UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/4 "2020-04-06T14:12:11Z")

</div>

Is this querying a single index? If not: is the `innerId.txt` field mapped the same in all involved indices?

As you can see in the response, only 2 out of 56 queried shards failed, thus the question.

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 6, 2020, 4:23pm UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/5 "2020-04-06T16:23:16Z")

</div>

It's querying an alias. We have a hot-warm architecture that is an ILM (index life-cycle policy), and yes the field is mapped same as there is a template involved.

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 7, 2020, 10:36am UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/6 "2020-04-07T10:36:50Z")

</div>

Furthermore, if I target a specific index for which I know is holding the document I'm searching for, I got the same error

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 7, 2020, 1:49pm UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/7 "2020-04-07T13:49:26Z")

</div>

What part of the ILM have those shards run through that are affected? shrinking? merging? what else?

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 8, 2020, 7:14am UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/8 "2020-04-08T07:14:15Z")

</div>

The policy has only hot and warm phases without any merging or shrinking involved.  
Here is the policy:

```auto
{
  "cas_ilm" : {
    "version" : 4,
    "modified_date" : "2020-01-05T07:48:10.127Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "10gb",
              "max_age" : "30d"
            },
            "set_priority" : {
              "priority" : 100
            }
          }
        },
        "warm" : {
          "min_age" : "30d",
          "actions" : {
            "allocate" : {
              "number_of_replicas" : 0,
              "include" : { },
              "exclude" : { },
              "require" : {
                "data" : "warm"
              }
            },
            "set_priority" : {
              "priority" : 50
            }
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 8, 2020, 1:22pm UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/9 "2020-04-08T13:22:51Z")

</div>

Hm, that doesn't look like it's an issue to me. Can you try escaping the slash?

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 8, 2020, 1:41pm UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/10 "2020-04-08T13:41:37Z")

</div>

Hi again.  
As I mentioned in the opening post if I escape the slash char:

```auto
        {
          "query_string": {
            "default_field": "innerId.txt",
            "query": "XMT01\\/195077567"
            }
        }

```

I end up getting all the documents which `"innerId"` field starts with `"XMT01"` ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2020, 1:41pm UTC](https://discuss.elastic.co/t/query-string-containing-the-forward-slash-raises-the-error-cannot-parse-encountered-eof/226645/11 "2020-05-06T13:41:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.