# Usage of colons in search
**URL:** https://discuss.elastic.co/t/usage-of-colons-in-search/9089
**Category:** Elasticsearch
**Created:** [September 21, 2012, 5:53am UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089 "2012-09-21T05:53:26Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Robin\_Verlangen](https://discuss.elastic.co/u/Robin_Verlangen)
#### Post date: [September 21, 2012, 5:53am UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089/1 "2012-09-21T05:53:26Z")
Hi there,
We found out that when we use colons ":" in our search, that it seems to
break? We searched for a time, like "09:22:50" and the request kept
pending. Is this a common issue, or did we do something wrong?
Best regards,
Robin Verlangen
_Software engineer_
\*
\*
W [http://www.robinverlangen.nl](http://www.robinverlangen.nl)
E robin@us2.nl
Disclaimer: The information contained in this message and attachments is
intended solely for the attention and use of the named addressee and may be
confidential. If you are not the intended recipient, you are reminded that
the information remains the property of the sender. You must not use,
disclose, distribute, copy, print or rely on this e-mail. If you have
received this message in error, please contact the sender immediately and
irrevocably delete this message and any copies.
--
---
### Author:  [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)
#### Post date: [September 21, 2012, 9:00am UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089/2 "2012-09-21T09:00:51Z")
Hi Robin
> We found out that when we use colons ":" in our search, that it seems
> to break? We searched for a time, like "09:22:50" and the request kept
> pending. Is this a common issue, or did we do something wrong?
Impossible to say without seeing what you actually did. See
[Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/help) for advice about how to present the
problem
clint
> Best regards,
>
> Robin Verlangen
> Software engineer
>
> W [http://www.robinverlangen.nl](http://www.robinverlangen.nl)
> E robin@us2.nl
>
> Disclaimer: The information contained in this message and attachments
> is intended solely for the attention and use of the named addressee
> and may be confidential. If you are not the intended recipient, you
> are reminded that the information remains the property of the sender.
> You must not use, disclose, distribute, copy, print or rely on this
> e-mail. If you have received this message in error, please contact the
> sender immediately and irrevocably delete this message and any copies.
>
> --
--
---
### Author:  [@Robin\_Verlangen](https://discuss.elastic.co/u/Robin_Verlangen)
#### Post date: [September 21, 2012, 5:42pm UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089/3 "2012-09-21T17:42:53Z")
Hi Clinton,
I don't think such a complex thing is necessary, just these 3 seps:
1. Create an index
2. Insert "[DEBUG] Fri Sep 21 19:38:58 CEST 2012"
3. Search for " Fri Sep 21 19:38:58 CEST 2012" (using a browser on
localhost:
[http://localhost:9200/2012-09-21/\_search?q=Fri%20Sep%2021%2019:38:58](http://localhost:9200/2012-09-21/_search?q=Fri%20Sep%2021%2019:38:58) )
Thank you for your time!
Best regards,
Robin Verlangen
_Software engineer_
\*
\*
W [http://www.robinverlangen.nl](http://www.robinverlangen.nl)
E robin@us2.nl
Disclaimer: The information contained in this message and attachments is
intended solely for the attention and use of the named addressee and may be
confidential. If you are not the intended recipient, you are reminded that
the information remains the property of the sender. You must not use,
disclose, distribute, copy, print or rely on this e-mail. If you have
received this message in error, please contact the sender immediately and
irrevocably delete this message and any copies.
2012/9/21 Clinton Gormley [clint@traveljury.com](mailto:clint@traveljury.com)
> Hi Robin
>
> > We found out that when we use colons ":" in our search, that it seems
> > to break? We searched for a time, like "09:22:50" and the request kept
> > pending. Is this a common issue, or did we do something wrong?
>
> Impossible to say without seeing what you actually did. See
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/help) for advice about how to present the
> problem
>
> clint
>
> > Best regards,
> >
> > Robin Verlangen
> > Software engineer
> >
> > W [http://www.robinverlangen.nl](http://www.robinverlangen.nl)
> > E robin@us2.nl
> >
> > Disclaimer: The information contained in this message and attachments
> > is intended solely for the attention and use of the named addressee
> > and may be confidential. If you are not the intended recipient, you
> > are reminded that the information remains the property of the sender.
> > You must not use, disclose, distribute, copy, print or rely on this
> > e-mail. If you have received this message in error, please contact the
> > sender immediately and irrevocably delete this message and any copies.
> >
> > --
>
> --
--
---
### Author:  [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)
#### Post date: [September 21, 2012, 5:51pm UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089/4 "2012-09-21T17:51:05Z")
Hi Robin
> I don't think such a complex thing is necessary, just these 3 seps:
All I was asking for was a recreation, which you have provided below 🙂
However, for anything more complex, I'd want to be able to copy and
paste it in order to test it out.
> 1. Create an index
> 2. Insert "[DEBUG] Fri Sep 21 19:38:58 CEST 2012"
> 3. Search for " Fri Sep 21 19:38:58 CEST 2012" (using a browser on
> localhost: [http://localhost:9200/2012-09-21/\_search?q=Fri%20Sep%2021%](http://localhost:9200/2012-09-21/_search?q=Fri%20Sep%2021%25)
> 2019:38:58 )
The ?q= search corresponds to the query string query
> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.
which uses the Lucene query parser syntax
[http://lucene.apache.org/core/3\_6\_0/queryparsersyntax.html](http://lucene.apache.org/core/3_6_0/queryparsersyntax.html)
so your search string is being parsed according to the syntax described
above. Colons are used to introduce field names. But FOO:FOO:FOO is a
syntax error, so you should have received an error in response from ES.
I get:
ParseException[Cannot parse 'Fri Sep 21 19:38:58': Encountered " ":" ": ""
clint
--
---
### Author:  [@Robin\_Verlangen](https://discuss.elastic.co/u/Robin_Verlangen)
#### Post date: [September 21, 2012, 5:52pm UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089/5 "2012-09-21T17:52:37Z")
Hmm, my page just hangs. But I understand the problem with the colons now.
Thank you for pointing that out 🙂 I'll just have to quote them.
Best regards,
Robin Verlangen
_Software engineer_
\*
\*
W [http://www.robinverlangen.nl](http://www.robinverlangen.nl)
E robin@us2.nl
Disclaimer: The information contained in this message and attachments is
intended solely for the attention and use of the named addressee and may be
confidential. If you are not the intended recipient, you are reminded that
the information remains the property of the sender. You must not use,
disclose, distribute, copy, print or rely on this e-mail. If you have
received this message in error, please contact the sender immediately and
irrevocably delete this message and any copies.
2012/9/21 Clinton Gormley [clint@traveljury.com](mailto:clint@traveljury.com)
> Hi Robin
>
> > I don't think such a complex thing is necessary, just these 3 seps:
>
> All I was asking for was a recreation, which you have provided below 🙂
> However, for anything more complex, I'd want to be able to copy and
> paste it in order to test it out.
>
> > 1. Create an index
> > 2. Insert "[DEBUG] Fri Sep 21 19:38:58 CEST 2012"
> > 3. Search for " Fri Sep 21 19:38:58 CEST 2012" (using a browser on
> > localhost: [http://localhost:9200/2012-09-21/\_search?q=Fri%20Sep%2021%](http://localhost:9200/2012-09-21/_search?q=Fri%20Sep%2021%25)
> > 2019:38:58 )
>
> The ?q= search corresponds to the query string query
>
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/query-string-query.html)
> which uses the Lucene query parser syntax
> [Apache Lucene - Query Parser Syntax](http://lucene.apache.org/core/3_6_0/queryparsersyntax.html)
>
> so your search string is being parsed according to the syntax described
> above. Colons are used to introduce field names. But FOO:FOO:FOO is a
> syntax error, so you should have received an error in response from ES.
>
> I get:
> ParseException[Cannot parse 'Fri Sep 21 19:38:58': Encountered " ":" ": ""
>
> clint
>
> --
--
---
### Author:  [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)
#### Post date: [September 21, 2012, 5:53pm UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089/6 "2012-09-21T17:53:26Z")
On Fri, 2012-09-21 at 19:52 +0200, Robin Verlangen wrote:
> Hmm, my page just hangs. But I understand the problem with the colons
> now. Thank you for pointing that out 🙂 I'll just have to quote them.
Or use the query DSL instead
It's a lot easier to have malformed query-string queries than with the
DSL
clint
> Best regards,
>
> Robin Verlangen
> Software engineer
>
> W [http://www.robinverlangen.nl](http://www.robinverlangen.nl)
> E robin@us2.nl
>
> Disclaimer: The information contained in this message and attachments
> is intended solely for the attention and use of the named addressee
> and may be confidential. If you are not the intended recipient, you
> are reminded that the information remains the property of the sender.
> You must not use, disclose, distribute, copy, print or rely on this
> e-mail. If you have received this message in error, please contact the
> sender immediately and irrevocably delete this message and any copies.
>
> 2012/9/21 Clinton Gormley [clint@traveljury.com](mailto:clint@traveljury.com)
> Hi Robin
> \>
> \>
> \> I don't think such a complex thing is necessary, just these
> 3 seps:
>
> ```
> All I was asking for was a recreation, which you have provided
> below :)
> However, for anything more complex, I'd want to be able to
> copy and
> paste it in order to test it out.
>
> > 1. Create an index
> > 2. Insert "[DEBUG] Fri Sep 21 19:38:58 CEST 2012"
> > 3. Search for " Fri Sep 21 19:38:58 CEST 2012" (using a
> browser on
> > localhost: http://localhost:9200/2012-09-21/_search?q=Fri%
> 20Sep%2021%
> > 2019:38:58 )
>
>
> The ?q= search corresponds to the query string query
> http://www.elasticsearch.org/guide/reference/query-dsl/query-string-query.html
> which uses the Lucene query parser syntax
> http://lucene.apache.org/core/3_6_0/queryparsersyntax.html
>
> so your search string is being parsed according to the syntax
> described
> above. Colons are used to introduce field names. But
> FOO:FOO:FOO is a
> syntax error, so you should have received an error in response
> from ES.
>
> I get:
> ParseException[Cannot parse 'Fri Sep 21 19:38:58': Encountered
> " ":" ": ""
>
> clint
>
>
>
> --
>
> ```
>
> --
--
---
### Author:  [@Robin\_Verlangen](https://discuss.elastic.co/u/Robin_Verlangen)
#### Post date: [September 21, 2012, 5:54pm UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089/7 "2012-09-21T17:54:40Z")
We will in the future as we're going to write our own interface on ES and
perform many post-processing steps. This was just for some manual testing
which caused me a tiny headache... 🙂
Best regards,
Robin Verlangen
_Software engineer_
\*
\*
W [http://www.robinverlangen.nl](http://www.robinverlangen.nl)
E robin@us2.nl
Disclaimer: The information contained in this message and attachments is
intended solely for the attention and use of the named addressee and may be
confidential. If you are not the intended recipient, you are reminded that
the information remains the property of the sender. You must not use,
disclose, distribute, copy, print or rely on this e-mail. If you have
received this message in error, please contact the sender immediately and
irrevocably delete this message and any copies.
2012/9/21 Clinton Gormley [clint@traveljury.com](mailto:clint@traveljury.com)
> On Fri, 2012-09-21 at 19:52 +0200, Robin Verlangen wrote:
>
> > Hmm, my page just hangs. But I understand the problem with the colons
> > now. Thank you for pointing that out 🙂 I'll just have to quote them.
>
> Or use the query DSL instead
>
> It's a lot easier to have malformed query-string queries than with the
> DSL
>
> clint
>
> > Best regards,
> >
> > Robin Verlangen
> > Software engineer
> >
> > W [http://www.robinverlangen.nl](http://www.robinverlangen.nl)
> > E robin@us2.nl
> >
> > Disclaimer: The information contained in this message and attachments
> > is intended solely for the attention and use of the named addressee
> > and may be confidential. If you are not the intended recipient, you
> > are reminded that the information remains the property of the sender.
> > You must not use, disclose, distribute, copy, print or rely on this
> > e-mail. If you have received this message in error, please contact the
> > sender immediately and irrevocably delete this message and any copies.
> >
> > 2012/9/21 Clinton Gormley [clint@traveljury.com](mailto:clint@traveljury.com)
> > Hi Robin
> > \>
> > \>
> > \> I don't think such a complex thing is necessary, just these
> > 3 seps:
> >
> > ```
> > All I was asking for was a recreation, which you have provided
> > below :)
> > However, for anything more complex, I'd want to be able to
> > copy and
> > paste it in order to test it out.
> >
> > > 1. Create an index
> > > 2. Insert "[DEBUG] Fri Sep 21 19:38:58 CEST 2012"
> > > 3. Search for " Fri Sep 21 19:38:58 CEST 2012" (using a
> > browser on
> > > localhost: http://localhost:9200/2012-09-21/_search?q=Fri%
> > 20Sep%2021%
> > > 2019:38:58 )
> >
> > The ?q= search corresponds to the query string query
> >
> > ```
>
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/query-dsl/query-string-query.html)
>
> > ```
> > which uses the Lucene query parser syntax
> > http://lucene.apache.org/core/3_6_0/queryparsersyntax.html
> >
> > so your search string is being parsed according to the syntax
> > described
> > above. Colons are used to introduce field names. But
> > FOO:FOO:FOO is a
> > syntax error, so you should have received an error in response
> > from ES.
> >
> > I get:
> > ParseException[Cannot parse 'Fri Sep 21 19:38:58': Encountered
> > " ":" ": ""
> >
> > clint
> >
> > --
> >
> > ```
> >
> > --
>
> --
--
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 3:11am UTC](https://discuss.elastic.co/t/usage-of-colons-in-search/9089/8 "2017-07-06T03:11:54Z")