# Search for mac addresses in messages with different forms
**URL:** https://discuss.elastic.co/t/search-for-mac-addresses-in-messages-with-different-forms/17583
**Category:** Elasticsearch
**Created:** [May 19, 2014, 9:02am UTC](https://discuss.elastic.co/t/search-for-mac-addresses-in-messages-with-different-forms/17583 "2014-05-19T09:02:28Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Bernard\_van\_de\_Koppe](https://discuss.elastic.co/u/Bernard_van_de_Koppe)
#### Post date: [May 19, 2014, 9:02am UTC](https://discuss.elastic.co/t/search-for-mac-addresses-in-messages-with-different-forms/17583/1 "2014-05-19T09:02:28Z")
Hi,
I use an url path//\_search?q=message:aa.bb.cc.dd.ee.ff to searc for
macadresses in the folowing forms:
aabbccddeeff
AA-BB-CC-DD-EE-FF
aa:bb:cc:dd:ee:ff
Questions:
1. Can I capture all of these forms in one query, or should I use an OR
query with all thinkable combinations.
2. How can I escape the : in queries??
Help verry much appreciated
Bernard
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@jprante](https://discuss.elastic.co/u/jprante)
#### Post date: [May 19, 2014, 9:05am UTC](https://discuss.elastic.co/t/search-for-mac-addresses-in-messages-with-different-forms/17583/2 "2014-05-19T09:05:52Z")
With a custom analyzer, you could index all three forms as tokens on this
field, and search for them without hassle (i.e. without expensive OR terms
in query or tedious ':' escaping)
Jörg
On Mon, May 19, 2014 at 11:02 AM, Bernard van de Koppel
[bernard@sipman.net](mailto:bernard@sipman.net)wrote:
> Hi,
>
> I use an url path//\_search?q=message:aa.bb.cc.dd.ee.ff to searc for
> macadresses in the folowing forms:
> aabbccddeeff
> AA-BB-CC-DD-EE-FF
> aa:bb:cc:dd:ee:ff
>
> Questions:
>
> 1. Can I capture all of these forms in one query, or should I use an
> OR query with all thinkable combinations.
> 2. How can I escape the : in queries??
>
> Help verry much appreciated
>
> Bernard
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAKdsXoEAH\_ewkCdXEwxAJSWLsWfBdf7fHkmhwOik660hA78rdA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAKdsXoEAH_ewkCdXEwxAJSWLsWfBdf7fHkmhwOik660hA78rdA%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@jprante](https://discuss.elastic.co/u/jprante)
#### Post date: [May 19, 2014, 9:12am UTC](https://discuss.elastic.co/t/search-for-mac-addresses-in-messages-with-different-forms/17583/3 "2014-05-19T09:12:03Z")
If you mean the colon escaping in the HTTP GET request, just use percent
escaping (%3A is a colon)
Jörg
On Mon, May 19, 2014 at 11:05 AM, [joergprante@gmail.com](mailto:joergprante@gmail.com) \<
[joergprante@gmail.com](mailto:joergprante@gmail.com)\> wrote:
> With a custom analyzer, you could index all three forms as tokens on this
> field, and search for them without hassle (i.e. without expensive OR terms
> in query or tedious ':' escaping)
>
> Jörg
>
> On Mon, May 19, 2014 at 11:02 AM, Bernard van de Koppel \<
> [bernard@sipman.net](mailto:bernard@sipman.net)\> wrote:
>
> > Hi,
> >
> > I use an url path//\_search?q=message:aa.bb.cc.dd.ee.ff to searc for
> > macadresses in the folowing forms:
> > aabbccddeeff
> > AA-BB-CC-DD-EE-FF
> > aa:bb:cc:dd:ee:ff
> >
> > Questions:
> >
> > 1. Can I capture all of these forms in one query, or should I use an
> > OR query with all thinkable combinations.
> > 2. How can I escape the : in queries??
> >
> > Help verry much appreciated
> >
> > Bernard
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAKdsXoFkO%3D9JXbhMBq87FfVdCrK-SFX%2Bm7jGJQ08uEABuwmbBQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAKdsXoFkO%3D9JXbhMBq87FfVdCrK-SFX%2Bm7jGJQ08uEABuwmbBQ%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Bernard\_van\_de\_Koppe](https://discuss.elastic.co/u/Bernard_van_de_Koppe)
#### Post date: [May 19, 2014, 11:40am UTC](https://discuss.elastic.co/t/search-for-mac-addresses-in-messages-with-different-forms/17583/4 "2014-05-19T11:40:09Z")
Hi Jorg,
When trying to sen it with the escape sequence, I get an error (was first
blaming the lwp library in perl, but Chrome does the same):
{"error":"SearchPhaseExecutionException[Failed to execute phase [query],
all shards failed; shardFailures
{[V-BGingdTFqPYUopr8066Q][logstash-2014.05.19][0]:
SearchParseException[[logstash-2014.05.19][0]: from[-1],size[-1]: Parse
Failure [Failed to parse source
[{"query":{"query\_string":{"query":"message:6c:62:6d:6b:1a:4f","lowercase\_expanded\_terms":true,"analyze\_wildcard":false}}}]]];
nested: QueryParsingException[[logstash-2014.05.19] Failed to parse query
[message:6c:62:6d:6b:1a:4f]]; nested: ParseException[Cannot parse
'message:6c:62:6d:6b:1a:4f': Encountered " ":" ": "" at line 1,
column 10.\nWas expecting one of:\n \n ...\n
...\n ...\n "+" ...\n "-" ...\n ...\n
"(" ...\n "\*" ...\n "^" ...\n ...\n
...\n \ ...\n ...\n ...\n
...\n "[" ...\n "{" ...\n ...\n];
nested: ParseException[Encountered " ":" ": "" at line 1, column 10.\
The query was
somehost/elasticsearch/\_search?q=message:6c%3A62%3A6d%3A6b%3A1a%3A4f
Op maandag 19 mei 2014 11:12:03 UTC+2 schreef Jörg Prante:
> If you mean the colon escaping in the HTTP GET request, just use percent
> escaping (%3A is a colon)
>
> Jörg
>
> On Mon, May 19, 2014 at 11:05 AM, [joerg...@gmail.com](mailto:joerg...@gmail.com) \ \<
> [joerg...@gmail.com](mailto:joerg...@gmail.com) \\> wrote:
>
> > With a custom analyzer, you could index all three forms as tokens on this
> > field, and search for them without hassle (i.e. without expensive OR terms
> > in query or tedious ':' escaping)
> >
> > Jörg
> >
> > On Mon, May 19, 2014 at 11:02 AM, Bernard van de Koppel \<
> > [ber...@sipman.net](mailto:ber...@sipman.net) \\> wrote:
> >
> > > Hi,
> > >
> > > I use an url path//\_search?q=message:aa.bb.cc.dd.ee.ff to searc for
> > > macadresses in the folowing forms:
> > > aabbccddeeff
> > > AA-BB-CC-DD-EE-FF
> > > aa:bb:cc:dd:ee:ff
> > >
> > > Questions:
> > >
> > > 1. Can I capture all of these forms in one query, or should I use an
> > > OR query with all thinkable combinations.
> > > 2. How can I escape the : in queries??
> > >
> > > Help verry much appreciated
> > >
> > > Bernard
> > >
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send
> > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e629f3ec-fa23-448d-bdd9-355ca718bd74%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e629f3ec-fa23-448d-bdd9-355ca718bd74%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Bernard\_van\_de\_Koppe](https://discuss.elastic.co/u/Bernard_van_de_Koppe)
#### Post date: [May 19, 2014, 12:15pm UTC](https://discuss.elastic.co/t/search-for-mac-addresses-in-messages-with-different-forms/17583/5 "2014-05-19T12:15:02Z")
Hi,
I solved this one, with escaping the colon with backslashes (thought I
tried this earlier ☹
/elasticsearch/\_search?q=message:6c:62:6d:6b:1a:4f
Now figuring out why I get some results with mac's in different formats
Op maandag 19 mei 2014 13:40:09 UTC+2 schreef Bernard van de Koppel:
> Hi Jorg,
>
> When trying to sen it with the escape sequence, I get an error (was first
> blaming the lwp library in perl, but Chrome does the same):
> {"error":"SearchPhaseExecutionException[Failed to execute phase [query],
> all shards failed; shardFailures
> {[V-BGingdTFqPYUopr8066Q][logstash-2014.05.19][0]:
> SearchParseException[[logstash-2014.05.19][0]: from[-1],size[-1]: Parse
> Failure [Failed to parse source
> [{"query":{"query\_string":{"query":"message:6c:62:6d:6b:1a:4f","lowercase\_expanded\_terms":true,"analyze\_wildcard":false}}}]]];
> nested: QueryParsingException[[logstash-2014.05.19] Failed to parse query
> [message:6c:62:6d:6b:1a:4f]]; nested: ParseException[Cannot parse
> 'message:6c:62:6d:6b:1a:4f': Encountered " ":" ": "" at line 1,
> column 10.\nWas expecting one of:\n \n ...\n
> ...\n ...\n "+" ...\n "-" ...\n ...\n
> "(" ...\n "\*" ...\n "^" ...\n ...\n
> ...\n \ ...\n ...\n ...\n
> ...\n "[" ...\n "{" ...\n ...\n];
> nested: ParseException[Encountered " ":" ": "" at line 1, column 10.\
>
> The query was
> somehost/elasticsearch/\_search?q=message:6c%3A62%3A6d%3A6b%3A1a%3A4f
>
> Op maandag 19 mei 2014 11:12:03 UTC+2 schreef Jörg Prante:
>
> > If you mean the colon escaping in the HTTP GET request, just use percent
> > escaping (%3A is a colon)
> >
> > Jörg
> >
> > On Mon, May 19, 2014 at 11:05 AM, [joerg...@gmail.com](mailto:joerg...@gmail.com) [joerg...@gmail.com](mailto:joerg...@gmail.com)wrote:
> >
> > > With a custom analyzer, you could index all three forms as tokens on
> > > this field, and search for them without hassle (i.e. without expensive OR
> > > terms in query or tedious ':' escaping)
> > >
> > > Jörg
> > >
> > > On Mon, May 19, 2014 at 11:02 AM, Bernard van de Koppel \<
> > > [ber...@sipman.net](mailto:ber...@sipman.net)\> wrote:
> > >
> > > > Hi,
> > > >
> > > > I use an url path//\_search?q=message:aa.bb.cc.dd.ee.ff to searc for
> > > > macadresses in the folowing forms:
> > > > aabbccddeeff
> > > > AA-BB-CC-DD-EE-FF
> > > > aa:bb:cc:dd:ee:ff
> > > >
> > > > Questions:
> > > >
> > > > 1. Can I capture all of these forms in one query, or should I use
> > > > an OR query with all thinkable combinations.
> > > > 2. How can I escape the : in queries??
> > > >
> > > > Help verry much appreciated
> > > >
> > > > Bernard
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google
> > > > Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from it, send
> > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com).
> > > > To view this discussion on the web visit
> > > > [https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/c9740b19-fb86-44cf-8d98-d1096fd4b350%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > > .
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/fda0ab35-1a75-45fc-9a86-560ee03dcc4e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/fda0ab35-1a75-45fc-9a86-560ee03dcc4e%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:28am UTC](https://discuss.elastic.co/t/search-for-mac-addresses-in-messages-with-different-forms/17583/6 "2017-07-06T01:28:31Z")