# String\_query doesn't respond to some characters

**URL:** <https://discuss.elastic.co/t/string-query-doesnt-respond-to-some-characters/338567>\
**Category:** Elasticsearch\
**Created:** [July 17, 2023, 1:39pm UTC](https://discuss.elastic.co/t/string-query-doesnt-respond-to-some-characters/338567 "2023-07-17T13:39:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![y34rz3r0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/y34rz3r0/32/124582_2.png) [@y34rz3r0](https://discuss.elastic.co/u/y34rz3r0)\
**Post date:** [July 17, 2023, 1:39pm UTC](https://discuss.elastic.co/t/string-query-doesnt-respond-to-some-characters/338567/1 "2023-07-17T13:39:46Z")

</div>

Hello! I have a misunderstanding of how `string_query` works.

**Index creating:**

```auto
PUT _index_template/test
{
  "priority": 500,
  "template": {
    "settings": {
      "index.default_pipeline": "set-timestamp"
    },
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "message": { "type": "text" }
      }
    }
  },
  "index_patterns": ["test*"]
}

```

**Filling the index with data:**

```auto
POST test/_bulk
{"index":{}}
{"message":"00 00 00", "type": "positive"}
{"index":{}}
{"message":"00_00_00", "type": "false positive"}
{"index":{}}
{"message":"00-00-00", "type": "false positive"}

```

**Request:**

```auto
GET test/_search
{
    "query": {
        "bool": {
            "must": [
                {
                  "query_string": {
                    "query": "/ <regexp> /",
                    "fields": ["message"],
                    "allow_leading_wildcard": "true",
                    "analyze_wildcard": "true",
                    "boost": 1
                  }
                },
                {
                    "range": {
                        "@timestamp": {
                            "from": "now-10d",
                            "to": "now",
                            "include_lower": true,
                            "include_upper": true,
                            "boost": 1
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    },
    "aggregations": {
        "indexes": {
            "terms": {
                "field": "_index",
                "size": 10,
                "min_doc_count": 1,
                "shard_min_doc_count": 0,
                "show_term_doc_count_error": false,
                "order": [
                    {
                        "_count": "desc"
                    },
                    {
                        "_key": "asc"
                    }
                ]
            }
        }
    }
}

```

Can someone explain to me why data with `" "` and with `"-"` are ignored. The `message` field containing these characters in the `text` is not in the response, even if they are explicitly specified in the regexp syntax.

Here is the regexps i tried:

```auto
"query": "/00[-_]{1}00[-_]{1}00/"
"query": "/00[\\s\\W_]00[\\s\\W_]00/"
"query": "/00.?00.?00/"
"query": "/00.*00.*00/"

```

Response always contained only document with value `00_00_00`.

```auto
{
  "took": 7,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 1,
      "relation": "eq"
    },
    "max_score": 2,
    "hits": [
      {
        "_index": "test",
        "_id": "1ic-ZIkBBNQA9kiNXSvQ",
        "_score": 2,
        "_source": {
          "@timestamp": "2023-07-17T14:25:55.960338327Z",
          "message": "00_00_00",
          "type": "positive"
        }
      }
    ]
  },
  "aggregations": {
    "indexes": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "logcrusher-test",
          "doc_count": 1
        }
      ]
    }
  }
}

```

I did not have such problems with the `script` method, but it, unfortunately, is not suitable for my project.

---

<div class="post-metadata">

**Author:** ![y34rz3r0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/y34rz3r0/32/124582_2.png) [@y34rz3r0](https://discuss.elastic.co/u/y34rz3r0)\
**Post date:** [July 17, 2023, 3:24pm UTC](https://discuss.elastic.co/t/string-query-doesnt-respond-to-some-characters/338567/2 "2023-07-17T15:24:15Z")

</div>

I understand that this is tokenization, but this understanding does not help me 😁

Probably the solution would be to disable field tokenization somehow, or tokenize the entire string, but I'm afraid this might cause problems with keyword limits.

---

<div class="post-metadata">

**Author:** ![y34rz3r0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/y34rz3r0/32/124582_2.png) [@y34rz3r0](https://discuss.elastic.co/u/y34rz3r0)\
**Post date:** [July 20, 2023, 7:40pm UTC](https://discuss.elastic.co/t/string-query-doesnt-respond-to-some-characters/338567/3 "2023-07-20T19:40:03Z")

</div>

I found a solution:

```auto
((/[2,4,5,8]{1}[0-9]{3}/) AND (/[0-9]{4}/) AND (/[0-9]{4}/) AND (/[0-9]{4}/)) OR (/[2,4,5,8]{1}[0-9]{3}([^0-9a-Z]?[0-9]{4}){3}/)

```

Concatenation with `AND` and `OR` solves the whitespace problem, whereas you can use regexp in `(/.../)`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2023, 7:40pm UTC](https://discuss.elastic.co/t/string-query-doesnt-respond-to-some-characters/338567/4 "2023-08-17T19:40:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.