Search for mac addresses in messages with different forms

Elastic Stack Elasticsearch
1

Hi,

I use an url path//_search?q=message:aa.bb.cc.dd.ee.ff to searc for
macadresses in the folowing forms:
aabbccddeeff
AA-BB-CC-DD-EE-FF
aa:bb:cc:dd:ee:ff

Questions:

  1. Can I capture all of these forms in one query, or should I use an OR
    query with all thinkable combinations.
  2. How can I escape the : in queries??

Help verry much appreciated

Bernard

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

With a custom analyzer, you could index all three forms as tokens on this
field, and search for them without hassle (i.e. without expensive OR terms
in query or tedious ':' escaping)

Jörg

On Mon, May 19, 2014 at 11:02 AM, Bernard van de Koppel
bernard@sipman.netwrote:

Hi,

I use an url path//_search?q=message:aa.bb.cc.dd.ee.ff to searc for
macadresses in the folowing forms:
aabbccddeeff
AA-BB-CC-DD-EE-FF
aa:bb:cc:dd:ee:ff

Questions:

  1. Can I capture all of these forms in one query, or should I use an
    OR query with all thinkable combinations.
  2. How can I escape the : in queries??

Help verry much appreciated

Bernard

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAKdsXoEAH_ewkCdXEwxAJSWLsWfBdf7fHkmhwOik660hA78rdA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

If you mean the colon escaping in the HTTP GET request, just use percent
escaping (%3A is a colon)

Jörg

On Mon, May 19, 2014 at 11:05 AM, joergprante@gmail.com <
joergprante@gmail.com> wrote:

With a custom analyzer, you could index all three forms as tokens on this
field, and search for them without hassle (i.e. without expensive OR terms
in query or tedious ':' escaping)

Jörg

On Mon, May 19, 2014 at 11:02 AM, Bernard van de Koppel <
bernard@sipman.net> wrote:

Hi,

I use an url path//_search?q=message:aa.bb.cc.dd.ee.ff to searc for
macadresses in the folowing forms:
aabbccddeeff
AA-BB-CC-DD-EE-FF
aa:bb:cc:dd:ee:ff

Questions:

  1. Can I capture all of these forms in one query, or should I use an
    OR query with all thinkable combinations.
  2. How can I escape the : in queries??

Help verry much appreciated

Bernard

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAKdsXoFkO%3D9JXbhMBq87FfVdCrK-SFX%2Bm7jGJQ08uEABuwmbBQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

4

Hi Jorg,

When trying to sen it with the escape sequence, I get an error (was first
blaming the lwp library in perl, but Chrome does the same):
{"error":"SearchPhaseExecutionException[Failed to execute phase [query],
all shards failed; shardFailures
{[V-BGingdTFqPYUopr8066Q][logstash-2014.05.19][0]:
SearchParseException[[logstash-2014.05.19][0]: from[-1],size[-1]: Parse
Failure [Failed to parse source
[{"query":{"query_string":{"query":"message:6c:62:6d:6b:1a:4f","lowercase_expanded_terms":true,"analyze_wildcard":false}}}]]];
nested: QueryParsingException[[logstash-2014.05.19] Failed to parse query
[message:6c:62:6d:6b:1a:4f]]; nested: ParseException[Cannot parse
'message:6c:62:6d:6b:1a:4f': Encountered " ":" ": "" at line 1,
column 10.\nWas expecting one of:\n \n ...\n
...\n ...\n "+" ...\n "-" ...\n ...\n
"(" ...\n "*" ...\n "^" ...\n ...\n
...\n <FUZZY_SLOP> ...\n ...\n ...\n
...\n "[" ...\n "{" ...\n ...\n ];
nested: ParseException[Encountered " ":" ": "" at line 1, column 10.\

The query was
somehost/elasticsearch/_search?q=message:6c%3A62%3A6d%3A6b%3A1a%3A4f

Op maandag 19 mei 2014 11:12:03 UTC+2 schreef Jörg Prante:

If you mean the colon escaping in the HTTP GET request, just use percent
escaping (%3A is a colon)

Jörg

On Mon, May 19, 2014 at 11:05 AM, joerg...@gmail.com <javascript:> <
joerg...@gmail.com <javascript:>> wrote:

With a custom analyzer, you could index all three forms as tokens on this
field, and search for them without hassle (i.e. without expensive OR terms
in query or tedious ':' escaping)

Jörg

On Mon, May 19, 2014 at 11:02 AM, Bernard van de Koppel <
ber...@sipman.net <javascript:>> wrote:

Hi,

I use an url path//_search?q=message:aa.bb.cc.dd.ee.ff to searc for
macadresses in the folowing forms:
aabbccddeeff
AA-BB-CC-DD-EE-FF
aa:bb:cc:dd:ee:ff

Questions:

  1. Can I capture all of these forms in one query, or should I use an
    OR query with all thinkable combinations.
  2. How can I escape the : in queries??

Help verry much appreciated

Bernard

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/e629f3ec-fa23-448d-bdd9-355ca718bd74%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

5

Hi,

I solved this one, with escaping the colon with backslashes (thought I
tried this earlier :frowning:
/elasticsearch/_search?q=message:6c:62:6d:6b:1a:4f

Now figuring out why I get some results with mac's in different formats

Op maandag 19 mei 2014 13:40:09 UTC+2 schreef Bernard van de Koppel:

Hi Jorg,

When trying to sen it with the escape sequence, I get an error (was first
blaming the lwp library in perl, but Chrome does the same):
{"error":"SearchPhaseExecutionException[Failed to execute phase [query],
all shards failed; shardFailures
{[V-BGingdTFqPYUopr8066Q][logstash-2014.05.19][0]:
SearchParseException[[logstash-2014.05.19][0]: from[-1],size[-1]: Parse
Failure [Failed to parse source
[{"query":{"query_string":{"query":"message:6c:62:6d:6b:1a:4f","lowercase_expanded_terms":true,"analyze_wildcard":false}}}]]];
nested: QueryParsingException[[logstash-2014.05.19] Failed to parse query
[message:6c:62:6d:6b:1a:4f]]; nested: ParseException[Cannot parse
'message:6c:62:6d:6b:1a:4f': Encountered " ":" ": "" at line 1,
column 10.\nWas expecting one of:\n \n ...\n
...\n ...\n "+" ...\n "-" ...\n ...\n
"(" ...\n "*" ...\n "^" ...\n ...\n
...\n <FUZZY_SLOP> ...\n ...\n ...\n
...\n "[" ...\n "{" ...\n ...\n ];
nested: ParseException[Encountered " ":" ": "" at line 1, column 10.\

The query was
somehost/elasticsearch/_search?q=message:6c%3A62%3A6d%3A6b%3A1a%3A4f

Op maandag 19 mei 2014 11:12:03 UTC+2 schreef Jörg Prante:

If you mean the colon escaping in the HTTP GET request, just use percent
escaping (%3A is a colon)

Jörg

On Mon, May 19, 2014 at 11:05 AM, joerg...@gmail.com joerg...@gmail.comwrote:

With a custom analyzer, you could index all three forms as tokens on
this field, and search for them without hassle (i.e. without expensive OR
terms in query or tedious ':' escaping)

Jörg

On Mon, May 19, 2014 at 11:02 AM, Bernard van de Koppel <
ber...@sipman.net> wrote:

Hi,

I use an url path//_search?q=message:aa.bb.cc.dd.ee.ff to searc for
macadresses in the folowing forms:
aabbccddeeff
AA-BB-CC-DD-EE-FF
aa:bb:cc:dd:ee:ff

Questions:

  1. Can I capture all of these forms in one query, or should I use
    an OR query with all thinkable combinations.
  2. How can I escape the : in queries??

Help verry much appreciated

Bernard

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/fda0ab35-1a75-45fc-9a86-560ee03dcc4e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.