Search for * in data

[jfromm (Joe Fromm)]

I have an application where in dictated results, the string "***" is put in to indicate that a dictated word can not be understood. I have a text field containing the output of the dictation, and when I look at the string I see the *** in the data.

However, I have been unable to search/filter for the string *** in the discover tool or with TSVB.

If I use *** as a filter string, it gets treated as three wildcards and anything with more than 3 tokens is returned (didn't spend a lot of time on that, so maybe I am not interpreting the results correctly)
If I use quotes "***", I get no results.
If I use backslash escaping \*\*\* I get no results.
If I use slash escaping /*/*/* I get no results.

Is this an issue with the analyzer used in processing the field? Or is it a problem getting the wildcard character escaped?

[stephenb (Stephen Brown)]

Hi @jfromm

Yup the standard analyzer is eating the "***".

Assuming this is a line of text or something take a look at these

POST _analyze
{
  "text": "hello *** friend"
}


POST _analyze
{
  "analyzer": "whitespace",
  "text": "hello *** friend"
}

then try

PUT my-new-idx/
{
  "mappings": {
    "properties": {
      "dictated_text": {
        "type": "text",
        "analyzer": "whitespace"
      }
    }
  }
}

POST my-new-idx/_doc
{
  "dictated_text" : "hello Mr *** thank you for coming to the proceeding"
}

POST my-new-idx/_search
{
  "query": {
    "match": {
      "dictated_text": "***"
    }
  }
}

This may not fix all your issues ... but should be a start

[stephenb (Stephen Brown)]

BTW I noticed you tagged KQL so I tried it .. worked too!

[jfromm (Joe Fromm)]

Thanks for the help Stephen. Off to configure the analyzer.