# Querying records having colon : characters in Elasticsearch
**URL:** https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401
**Category:** Elasticsearch
**Created:** [September 30, 2015, 11:26am UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401 "2015-09-30T11:26:20Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@asatsi](https://discuss.elastic.co/u/asatsi)
#### Post date: [September 30, 2015, 11:26am UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401/1 "2015-09-30T11:26:20Z")
Hi,
I am getting very strange results when I query a record which contains a Mac Address having multiple colon characters e.g. 80:c5:e6:36:6a:b4 using the query -\> bool -\> must -\> match query via Curl. I tried escaping using \ but did not help. Anybody seen this behaviour? Any solution?
---
### Author:  [@jpountz](https://discuss.elastic.co/u/jpountz)
#### Post date: [September 30, 2015, 11:45am UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401/2 "2015-09-30T11:45:24Z")
Can you provide a script with curl commands that reproduces the issue?
---
### Author:  [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)
#### Post date: [September 30, 2015, 11:57am UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401/3 "2015-09-30T11:57:32Z")
What do you mean by strange results? Error? Unexpected search results?
---
### Author:  [@asatsi](https://discuss.elastic.co/u/asatsi)
#### Post date: [September 30, 2015, 11:59am UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401/4 "2015-09-30T11:59:16Z")
Sure. Here's the query used:
curl -s -d '{ "query": { "filtered": { "query": { "bool": { "must" : [{"match": {"mac\_address": "80:c5:e6:36:6a:b4" } }] } }, "filter": { "range" :{ "@timestamp" :{ "gt": "2015-09-11T01:00:00", "lt": "2015-09-11T23:00:00", "time\_zone": "+5:30" } } } } }, "\_source": ["ipaddress", "mac\_address", "@timestamp"], "sort": "@timestamp" }' [http://eshost:9200/logstash-data-2015.09.11/\_search?size=10000&pretty](http://eshost:9200/logstash-data-2015.09.11/_search?size=10000&pretty)
I tried escaping : character but it didn't help.
---
### Author:  [@asatsi](https://discuss.elastic.co/u/asatsi)
#### Post date: [September 30, 2015, 12:12pm UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401/5 "2015-09-30T12:12:14Z")
Instead of match when I used match\_phrase, the query gave the expected results matching the query containing the MacID only now! However with only "match" it gave way too many incorrect results.
---
### Author:  [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)
#### Post date: [October 2, 2015, 1:38am UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401/6 "2015-10-02T01:38:20Z")
I'm betting that the mac address is being tokenized on the colons, creating several unique search terms. So when you search, you get any mac address that matches any of the two character hex values. The same way you'd get the document "cat dog" if you just searched for "cat mouse." Phrase queries work because it enforces that each term is adjacent, much like you might search with quotes on Google for "cat dog"
You probably want this field to be [not\_analyzed](https://www.elastic.co/guide/en/elasticsearch/guide/current/mapping-intro.html#custom-field-mappings) which will only allow exact matches. However you may also want to perform [lowercasing](https://www.elastic.co/guide/en/elasticsearch/reference/1.4/analysis-lowercase-tokenfilter.html) as case doesn't matter in hex values.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:47pm UTC](https://discuss.elastic.co/t/querying-records-having-colon-characters-in-elasticsearch/31401/7 "2017-07-05T23:47:08Z")