# Trying to search for the following "?confid" which is in a string field - how to search

**URL:** <https://discuss.elastic.co/t/trying-to-search-for-the-following-confid-which-is-in-a-string-field-how-to-search/20776>\
**Category:** Elasticsearch\
**Created:** [November 17, 2014, 8:34am UTC](https://discuss.elastic.co/t/trying-to-search-for-the-following-confid-which-is-in-a-string-field-how-to-search/20776 "2014-11-17T08:34:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bill\_Shetti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bill_shetti/32/1084_2.png) [@Bill\_Shetti](https://discuss.elastic.co/u/Bill_Shetti)\
**Post date:** [November 17, 2014, 8:34am UTC](https://discuss.elastic.co/t/trying-to-search-for-the-following-confid-which-is-in-a-string-field-how-to-search/20776/1 "2014-11-17T08:34:23Z")

</div>

I have tried searching for "?confid", I 've tried the following

[root@node4 logstash]# curl -XGET  
'[http://localhost:9200/logstash-2014.11.16/\_search?pretty](http://localhost:9200/logstash-2014.11.16/_search?pretty)' -d '

{

"query": {

"filtered":{

```
 "filter": {

   "term": { "message":"?confid"}

  }

}

```

}

}'

OUTPUT:

{

"took" : 1,

"timed\_out" : false,

"\_shards" : {

```
"total" : 5,

"successful" : 5,

"failed" : 0

```

},

"hits" : {

```
"total" : 0,

"max_score" : null,

"hits" : []

```

}

}

Tried the following:

[root@node4 logstash]# curl -XGET  
'[http://localhost:9200/logstash-2014.11.16/\_search?pretty](http://localhost:9200/logstash-2014.11.16/_search?pretty)' -d '

{

"query": {

"filtered":{

```
 "filter": {

   "term": { "message":"\?confid"}

  }

}

```

}

}'

{

"error" : "SearchPhaseExecutionException[Failed to execute phase [query],  
all shards failed; shardFailures  
{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][0]:  
SearchParseException[[logstash-2014.11.16][0]: from[-1],size[-1]: Parse  
Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
"filter": {\n "term": { "message":"\?confid"}\n }\n  
}\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
63)\n at [Source: [B@6bdb244b; line: 6, column: 31]];  
}{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][1]:  
SearchParseException[[logstash-2014.11.16][1]: from[-1],size[-1]: Parse  
Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
"filter": {\n "term": { "message":"\?confid"}\n }\n  
}\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
63)\n at [Source: [B@6bdb244b; line: 6, column: 31]];  
}{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][2]:  
SearchParseException[[logstash-2014.11.16][2]: from[-1],size[-1]: Parse  
Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
"filter": {\n "term": { "message":"\?confid"}\n }\n  
}\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
63)\n at [Source: [B@6bdb244b; line: 6, column: 31]];  
}{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][3]:  
SearchParseException[[logstash-2014.11.16][3]: from[-1],size[-1]: Parse  
Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
"filter": {\n "term": { "message":"\?confid"}\n }\n  
}\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
63)\n at [Source: [B@6bdb244b; line: 6, column: 31]];  
}{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][4]:  
SearchParseException[[logstash-2014.11.16][4]: from[-1],size[-1]: Parse  
Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
"filter": {\n "term": { "message":"\?confid"}\n }\n  
}\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
63)\n at [Source: [B@6bdb244b; line: 6, column: 31]]; }]",

"status" : 400

}

HOW TO GET THE "?" searched? IT SEEMS "?" DOESN't WORK.

I am running: elastic search version: "1.3.4"

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8b68bd5e-4292-485b-be4b-ccdf62f484e7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8b68bd5e-4292-485b-be4b-ccdf62f484e7%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Bill\_Shetti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bill_shetti/32/1084_2.png) [@Bill\_Shetti](https://discuss.elastic.co/u/Bill_Shetti)\
**Post date:** [November 17, 2014, 4:46pm UTC](https://discuss.elastic.co/t/trying-to-search-for-the-following-confid-which-is-in-a-string-field-how-to-search/20776/2 "2014-11-17T16:46:15Z")

</div>

As clarification - we are looking to use curl (as a test) to search for a  
literal question mark "?". We've tried the "?" in the following "?confid"  
and this also does not work.

suggestions.

On Mon, Nov 17, 2014 at 12:34 AM, Bill Shetti [billshetti@gmail.com](mailto:billshetti@gmail.com) wrote:

> I have tried searching for "?confid", I 've tried the following
> 
> [root@node4 logstash]# curl -XGET '  
> [http://localhost:9200/logstash-2014.11.16/\_search?pretty](http://localhost:9200/logstash-2014.11.16/_search?pretty)' -d '
> 
> {
> 
> "query": {
> 
> "filtered":{
> 
> ```
> "filter": {
> 
> "term": { "message":"?confid"}
> 
> }
> 
> }
> 
> ```
> 
> }
> 
> }'
> 
> OUTPUT:
> 
> {
> 
> "took" : 1,
> 
> "timed\_out" : false,
> 
> "\_shards" : {
> 
> ```
> "total" : 5,
> 
> "successful" : 5,
> 
> "failed" : 0
> 
> ```
> 
> },
> 
> "hits" : {
> 
> ```
> "total" : 0,
> 
> "max_score" : null,
> 
> "hits" : []
> 
> ```
> 
> }
> 
> }
> 
> Tried the following:
> 
> [root@node4 logstash]# curl -XGET '  
> [http://localhost:9200/logstash-2014.11.16/\_search?pretty](http://localhost:9200/logstash-2014.11.16/_search?pretty)' -d '
> 
> {
> 
> "query": {
> 
> "filtered":{
> 
> ```
> "filter": {
> 
> "term": { "message":"\?confid"}
> 
> }
> 
> }
> 
> ```
> 
> }
> 
> }'
> 
> {
> 
> "error" : "SearchPhaseExecutionException[Failed to execute phase  
> [query], all shards failed; shardFailures  
> {[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][0]:  
> SearchParseException[[logstash-2014.11.16][0]: from[-1],size[-1]: Parse  
> Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
> "filter": {\n "term": { "message":"\?confid"}\n }\n  
> }\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
> parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
> 63)\n at [Source: [B@6bdb244b; line: 6, column: 31]];  
> }{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][1]:  
> SearchParseException[[logstash-2014.11.16][1]: from[-1],size[-1]: Parse  
> Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
> "filter": {\n "term": { "message":"\?confid"}\n }\n  
> }\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
> parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
> 63)\n at [Source: [B@6bdb244b; line: 6, column: 31]];  
> }{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][2]:  
> SearchParseException[[logstash-2014.11.16][2]: from[-1],size[-1]: Parse  
> Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
> "filter": {\n "term": { "message":"\?confid"}\n }\n  
> }\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
> parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
> 63)\n at [Source: [B@6bdb244b; line: 6, column: 31]];  
> }{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][3]:  
> SearchParseException[[logstash-2014.11.16][3]: from[-1],size[-1]: Parse  
> Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
> "filter": {\n "term": { "message":"\?confid"}\n }\n  
> }\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
> parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
> 63)\n at [Source: [B@6bdb244b; line: 6, column: 31]];  
> }{[Wv1luevnSfCUKjlWZjtKaQ][logstash-2014.11.16][4]:  
> SearchParseException[[logstash-2014.11.16][4]: from[-1],size[-1]: Parse  
> Failure [Failed to parse source [\n{\n"query": {\n "filtered":{\n  
> "filter": {\n "term": { "message":"\?confid"}\n }\n  
> }\n }\n}]]]; nested: QueryParsingException[[logstash-2014.11.16] Failed to  
> parse]; nested: JsonParseException[Unrecognized character escape '?' (code  
> 63)\n at [Source: [B@6bdb244b; line: 6, column: 31]]; }]",
> 
> "status" : 400
> 
> }
> 
> HOW TO GET THE "?" searched? IT SEEMS "?" DOESN't WORK.
> 
> I am running: Elasticsearch version: "1.3.4"
> 
> --  
> You received this message because you are subscribed to a topic in the  
> Google Groups "elasticsearch" group.  
> To unsubscribe from this topic, visit  
> [https://groups.google.com/d/topic/elasticsearch/od2ip65toMo/unsubscribe](https://groups.google.com/d/topic/elasticsearch/od2ip65toMo/unsubscribe).  
> To unsubscribe from this group and all its topics, send an email to  
> [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> To view this discussion on the web visit  
> [https://groups.google.com/d/msgid/elasticsearch/8b68bd5e-4292-485b-be4b-ccdf62f484e7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8b68bd5e-4292-485b-be4b-ccdf62f484e7%40googlegroups.com)  
> [https://groups.google.com/d/msgid/elasticsearch/8b68bd5e-4292-485b-be4b-ccdf62f484e7%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/8b68bd5e-4292-485b-be4b-ccdf62f484e7%40googlegroups.com?utm_medium=email&utm_source=footer)  
> .  
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAMhuXwk99dyfpOxd1N8-pkSyhX%3D85X\_KRoaMrO9LHsJhZVVhQQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAMhuXwk99dyfpOxd1N8-pkSyhX%3D85X_KRoaMrO9LHsJhZVVhQQ%40mail.gmail.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:49am UTC](https://discuss.elastic.co/t/trying-to-search-for-the-following-confid-which-is-in-a-string-field-how-to-search/20776/3 "2017-07-06T00:49:30Z")

</div>