# Strange query result: "from=\<\>" matches "from=\" **URL:** \ **Category:** Elasticsearch\ **Created:** [March 11, 2013, 12:16pm UTC](https://discuss.elastic.co/t/strange-query-result-from-matches-from-foobar/11094 "2013-03-11T12:16:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![shadyabhi](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@shadyabhi](https://discuss.elastic.co/u/shadyabhi)\ **Post date:** [March 11, 2013, 12:16pm UTC](https://discuss.elastic.co/t/strange-query-result-from-matches-from-foobar/11094/1 "2013-03-11T12:16:10Z")
Hi all, This is probably an easy one. My search query is this $ curl -XGET [http://localhost:9200/logs/\_search?pretty](http://localhost:9200/logs/_search?pretty) -d '{ "query": { "query\_string": { "default\_operator": "OR", "query": "message:"from=\<\>"", "default\_field": "\_all" } } }' The above query matches logs documents that have "from=" in the message field. I am not sure why! Full output of the query can be seen here: [http://sprunge.us/PLJC](http://sprunge.us/PLJC) Basically, I want to search for messages that have "from=\<\>" in the "@message" field in the logs I'm indexing using logstash. I'm using Kibana to search text but I don't think that all this is relevant here. So, what's really going on here. I also tried looking in lucene query syntax and I don't find "\<\>" having a special meaning. Regards, shadyabhi -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [March 11, 2013, 4:19pm UTC](https://discuss.elastic.co/t/strange-query-result-from-matches-from-foobar/11094/2 "2013-03-11T16:19:41Z")
The extra characters are parsed out by the analyzer. You can see the behavior yourself by using the analysis API: [http://localhost:9200/\_analyze?text="from%3D\<\>"](http://localhost:9200/_analyze?text=%22from%3D%3C%3E%22) Switching to a term query will preserve the text, but the match would need to be exact. Try playing around with the analysis or the type of query (prefix, term). -- Ivan On Mon, Mar 11, 2013 at 5:16 AM, Abhijeet [abhijeet.1989@gmail.com](mailto:abhijeet.1989@gmail.com) wrote: > Hi all, > > This is probably an easy one. My search query is this > > $ curl -XGET [http://localhost:9200/logs/\_\*\*search?pretty](http://localhost:9200/logs/_**search?pretty)[http://localhost:9200/logs/\_search?pretty](http://localhost:9200/logs/_search?pretty)-d '{ > "query": { > "query\_string": { > "default\_operator": "OR", > "query": "message:"from=\<\>"", > "default\_field": "\_all" > } > } > }' > > The above query matches logs documents that have "from=" in the > message field. I am not sure why! > Full output of the query can be seen here: [http://sprunge.us/PLJC](http://sprunge.us/PLJC) > > Basically, I want to search for messages that have "from=\<\>" in the > "@message" field in the logs I'm indexing using logstash. I'm using Kibana > to search text but I don't think that all this is relevant here. > > So, what's really going on here. I also tried looking in lucene query > syntax and I don't find "\<\>" having a special meaning. > > Regards, > shadyabhi > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to elasticsearch+unsubscribe@\*\*[googlegroups.com](http://googlegroups.com)[elasticsearch%2Bunsubscribe@googlegroups.com](mailto:elasticsearch%2Bunsubscribe@googlegroups.com) > . > For more options, visit [https://groups.google.com/\*\*groups/opt\_out](https://groups.google.com/**groups/opt_out)[https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out) > . -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![shadyabhi](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@shadyabhi](https://discuss.elastic.co/u/shadyabhi)\ **Post date:** [March 12, 2013, 9:24am UTC](https://discuss.elastic.co/t/strange-query-result-from-matches-from-foobar/11094/3 "2013-03-12T09:24:21Z")
On Mon, Mar 11, 2013 at 9:49 PM, Ivan Brusic [ivan@brusic.com](mailto:ivan@brusic.com) wrote: > The extra characters are parsed out by the analyzer. You can see the > behavior yourself by using the analysis API: > [http://localhost:9200/\_analyze?text="from%3D\<\>"](http://localhost:9200/_analyze?text=%22from%3D%3C%3E%22) Thanks for pointing me to the right direction Ivan. I read about Analyzers and got a hang of what you meant. I am actually storing logs in ES so I plan to set analyzer to whitespace. I think that'll eliminate the issue. (Still need to test it) > Switching to a term query will preserve the text, but the match would need > to be exact. Try playing around with the analysis or the type of query > (prefix, term). Can you elaborate on this? What do you mean by "match would need to be exact" ? Can you explain a bit about term and prefix queries? I am a newbie in ES so pls bear with me. > -- > Ivan > > On Mon, Mar 11, 2013 at 5:16 AM, Abhijeet [abhijeet.1989@gmail.com](mailto:abhijeet.1989@gmail.com) wrote: > > > Hi all, > > > > This is probably an easy one. My search query is this > > > > $ curl -XGET [http://localhost:9200/logs/\_\*\*search?pretty](http://localhost:9200/logs/_**search?pretty)[http://localhost:9200/logs/\_search?pretty](http://localhost:9200/logs/_search?pretty)-d '{ > > "query": { > > "query\_string": { > > "default\_operator": "OR", > > "query": "message:"from=\<\>"", > > "default\_field": "\_all" > > } > > } > > }' > > > > The above query matches logs documents that have "from=" in the > > message field. I am not sure why! > > Full output of the query can be seen here: [http://sprunge.us/PLJC](http://sprunge.us/PLJC) > > > > Basically, I want to search for messages that have "from=\<\>" in the > > "@message" field in the logs I'm indexing using logstash. I'm using Kibana > > to search text but I don't think that all this is relevant here. > > > > So, what's really going on here. I also tried looking in lucene query > > syntax and I don't find "\<\>" having a special meaning. > > > > Regards, > > shadyabhi > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to elasticsearch+unsubscribe@\*\*[googlegroups.com](http://googlegroups.com)[elasticsearch%2Bunsubscribe@googlegroups.com](mailto:elasticsearch%2Bunsubscribe@googlegroups.com) > > . > > For more options, visit [https://groups.google.com/\*\*groups/opt\_out](https://groups.google.com/**groups/opt_out)[https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out) > > . > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- Regards, Abhijeet Rastogi (shadyabhi) > **[New community features for Google Chat and an update on Currents](https://workspaceupdates.googleblog.com/2023/04/new-community-features-for-google-chat-and-an-update-currents%20.html)** > > Note:  This blog post outlines upcoming changes to Google Currents for Workspace users. For information on the previous deprecation of Googl... -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [March 12, 2013, 9:39pm UTC](https://discuss.elastic.co/t/strange-query-result-from-matches-from-foobar/11094/4 "2013-03-12T21:39:00Z")
A term query does not analyze the text and it only does exact matches. A term query for the term "from" will not match "from=". Without knowing too much of your content, a whitespace analyzer should work. A whitespace analyzer is similar to a keyword analyzer if there are no whitespaces in your content. -- Ivan On Tue, Mar 12, 2013 at 2:24 AM, Abhijeet Rastogi [abhijeet.1989@gmail.com](mailto:abhijeet.1989@gmail.com)wrote: > On Mon, Mar 11, 2013 at 9:49 PM, Ivan Brusic [ivan@brusic.com](mailto:ivan@brusic.com) wrote: > > > The extra characters are parsed out by the analyzer. You can see the > > behavior yourself by using the analysis API: > > [http://localhost:9200/\_analyze?text="from%3D\<\>"](http://localhost:9200/_analyze?text=%22from%3D%3C%3E%22) > > Thanks for pointing me to the right direction Ivan. I read about Analyzers > and got a hang of what you meant. I am actually storing logs in ES so I > plan to set analyzer to whitespace. I think that'll eliminate the issue. > (Still need to test it) > > > Switching to a term query will preserve the text, but the match would > > need to be exact. Try playing around with the analysis or the type of query > > (prefix, term). > > Can you elaborate on this? What do you mean by "match would need to be > exact" ? Can you explain a bit about term and prefix queries? I am a newbie > in ES so pls bear with me. > > > -- > > Ivan > > > > On Mon, Mar 11, 2013 at 5:16 AM, Abhijeet [abhijeet.1989@gmail.com](mailto:abhijeet.1989@gmail.com)wrote: > > > > > Hi all, > > > > > > This is probably an easy one. My search query is this > > > > > > $ curl -XGET [http://localhost:9200/logs/\_\*\*search?pretty](http://localhost:9200/logs/_**search?pretty)[http://localhost:9200/logs/\_search?pretty](http://localhost:9200/logs/_search?pretty)-d '{ > > > "query": { > > > "query\_string": { > > > "default\_operator": "OR", > > > "query": "message:"from=\<\>"", > > > "default\_field": "\_all" > > > } > > > } > > > }' > > > > > > The above query matches logs documents that have "from=" in the > > > message field. I am not sure why! > > > Full output of the query can be seen here: [http://sprunge.us/PLJC](http://sprunge.us/PLJC) > > > > > > Basically, I want to search for messages that have "from=\<\>" in the > > > "@message" field in the logs I'm indexing using logstash. I'm using Kibana > > > to search text but I don't think that all this is relevant here. > > > > > > So, what's really going on here. I also tried looking in lucene query > > > syntax and I don't find "\<\>" having a special meaning. > > > > > > Regards, > > > shadyabhi > > > > > > -- > > > You received this message because you are subscribed to the Google > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send > > > an email to elasticsearch+unsubscribe@\*\*[googlegroups.com](http://googlegroups.com)[elasticsearch%2Bunsubscribe@googlegroups.com](mailto:elasticsearch%2Bunsubscribe@googlegroups.com) > > > . > > > For more options, visit [https://groups.google.com/\*\*groups/opt\_out](https://groups.google.com/**groups/opt_out)[https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out) > > > . > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > Regards, > Abhijeet Rastogi (shadyabhi) > [Google Workspace Updates: New community features for Google Chat and an update on Currents](https://plus.google.com/107316377741966576356/) > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![shadyabhi](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@shadyabhi](https://discuss.elastic.co/u/shadyabhi)\ **Post date:** [March 13, 2013, 9:46am UTC](https://discuss.elastic.co/t/strange-query-result-from-matches-from-foobar/11094/5 "2013-03-13T09:46:40Z")
The problem with Whitespace analyzer is, if I set that and have a log line like: "Message contains from=\<\>" and "Message contains from=[myemail@com](mailto:myemail@com) If I search for myemail@com, I will not get the second line in search results. I'm using Kibana to search my logs in ES. On Wed, Mar 13, 2013 at 3:09 AM, Ivan Brusic [ivan@brusic.com](mailto:ivan@brusic.com) wrote: > A term query does not analyze the text and it only does exact matches. A > term query for the term "from" will not match "from=". Without > knowing too much of your content, a whitespace analyzer should work. > > A whitespace analyzer is similar to a keyword analyzer if there are no > whitespaces in your content. > > -- > Ivan -- Regards, Abhijeet Rastogi (shadyabhi) > **[New community features for Google Chat and an update on Currents](https://workspaceupdates.googleblog.com/2023/04/new-community-features-for-google-chat-and-an-update-currents%20.html)** > > Note:  This blog post outlines upcoming changes to Google Currents for Workspace users. For information on the previous deprecation of Googl... -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:46am UTC](https://discuss.elastic.co/t/strange-query-result-from-matches-from-foobar/11094/6 "2017-07-06T02:46:49Z")