# Uppcase letters in request cause no results to be found?

**URL:** <https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004>\
**Category:** Elasticsearch\
**Created:** [May 26, 2016, 12:29am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004 "2016-05-26T00:29:27Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Wurtz](https://avatars.discourse-cdn.com/v4/letter/m/c0e974/32.png) [@Mike\_Wurtz](https://discuss.elastic.co/u/Mike_Wurtz)\
**Post date:** [May 26, 2016, 12:29am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/1 "2016-05-26T00:29:27Z")

</div>

Elasticsearch v5 Alpha2

I'm noticing something bizarre while trying to search our cluster via API. It seems as if I include an uppercase character in my wildcard or regexp string, no results come back.. For example:

This works:

```auto
{
    "query" : {
        "bool" : {
            "must" : {
                "wildcard" : {
                    "message" : "*dapter*"
                }
            },
            "filter" : {
                "range" : {"@timestamp" : {"gte" : "now-15m"}}
            }
        }
    }
}

```

This query yields results:

```auto
"hits": {
    "total": 58,
    "max_score": 1,

```

And I can see one of the results contains the message string:

```auto
<log realm=\"org.jpos.security.hsm.thales.ThalesAdapter\" at=\"Thu May 26 00:14:45.962 GMT+00:00 2016\" lifespan=\"23ms\">\n <trace>\n <elapsed-time>22ms</elapsed-time>\n </trace>\n</log>

```

However if I search for `*Adapter*` instead of `*dapter` in my query:

```auto
{
    "query" : {
        "bool" : {
            "must" : {
                "wildcard" : {
                    "message" : "*Adapter*"
                }
            },
            "filter" : {
                "range" : {"@timestamp" : {"gte" : "now-15m"}}
            }
        }
    }
}

```

I get nothing:

```auto
{
  "took": 7,
  "timed_out": false,
  "_shards": {
    "total": 9,
    "successful": 9,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  }
}

```

What am I missing?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 26, 2016, 5:16am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/2 "2016-05-26T05:16:14Z")

</div>

Wildcard queries are not analyzed.

[https://www.elastic.co/guide/en/elasticsearch/reference/2.3/query-dsl-wildcard-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/query-dsl-wildcard-query.html)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 26, 2016, 5:18am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/3 "2016-05-26T05:18:41Z")

</div>

BTW don't use wildcards specifically at the beginning.

Will be super slow

---

<div class="post-metadata">

**Author:** ![Mike\_Wurtz](https://avatars.discourse-cdn.com/v4/letter/m/c0e974/32.png) [@Mike\_Wurtz](https://discuss.elastic.co/u/Mike_Wurtz)\
**Post date:** [May 26, 2016, 6:28am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/4 "2016-05-26T06:28:41Z")

</div>

I've noticed the same behavior with regexp queries.. Why would it match some strings but not others in the same field?

```auto
"regexp" : {
                    "message" : ".*dapter.*"
                }

```

FInds results,

```auto
"regexp" : {
                    "message" : ".*Adapter.*"
                }

```

Finds none.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [May 26, 2016, 7:40am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/5 "2016-05-26T07:40:18Z")

</div>

It's the way analysis is working. `Adapter` has been indexed as `adapter` by default (unless you change analyzer settings).

If you compare `Adapter` and `adapter` they won't match.

That's what is happening here behind the scene. The regex or the wildcard is applied as is.

Try with `".*adapter.*"` for example.

You can also read this [https://www.elastic.co/guide/en/elasticsearch/reference/2.3/query-dsl-query-string-query.html#\_wildcards](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/query-dsl-query-string-query.html#_wildcards)

---

<div class="post-metadata">

**Author:** ![Mike\_Wurtz](https://avatars.discourse-cdn.com/v4/letter/m/c0e974/32.png) [@Mike\_Wurtz](https://discuss.elastic.co/u/Mike_Wurtz)\
**Post date:** [May 31, 2016, 11:40pm UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/6 "2016-05-31T23:40:12Z")

</div>

Using the query string clause works much better for me..

```auto
{
    "query" : {
        "bool" : {
            "must" : {
                "query_string" : {
                    "default_field" : "message",
                    "query" : "host:*myserver* message:\"ERROR\""
                }
            },
            "filter" : {
                "range" : {"@timestamp" : {"gte" : "now-15m"}}
            }
        }
    }
}

```

Thanks.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 1, 2016, 6:14am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/7 "2016-06-01T06:14:03Z")

</div>

Note that by default this will gives you data where `host` contains `server` **OR** `message` is `ERROR`.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 1, 2016, 6:14am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/8 "2016-06-01T06:14:44Z")

</div>

And again, `host:*myserver*` could be terribly slow.

---

<div class="post-metadata">

**Author:** ![Mike\_Wurtz](https://avatars.discourse-cdn.com/v4/letter/m/c0e974/32.png) [@Mike\_Wurtz](https://discuss.elastic.co/u/Mike_Wurtz)\
**Post date:** [June 1, 2016, 6:34am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/9 "2016-06-01T06:34:26Z")

</div>

What's the best way to filter by partial host string?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 1, 2016, 6:46am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/10 "2016-06-01T06:46:48Z")

</div>

Generate subtokens at index time using ngram strategy. But this will take more disk space.

Read: [https://www.elastic.co/guide/en/elasticsearch/reference/2.3/analysis-ngram-tokenfilter.html](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/analysis-ngram-tokenfilter.html)

---

<div class="post-metadata">

**Author:** ![sandipmavani](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@sandipmavani](https://discuss.elastic.co/u/sandipmavani)\
**Post date:** [June 1, 2016, 7:02am UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/11 "2016-06-01T07:02:40Z")

</div>

Hi @Mike_Wurtz can You got Proper solution for this issue.  
I facing same issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:47pm UTC](https://discuss.elastic.co/t/uppcase-letters-in-request-cause-no-results-to-be-found/51004/12 "2017-07-05T22:47:25Z")

</div>