# Watcher searching for query term containing hyphens

**URL:** https://discuss.elastic.co/t/watcher-searching-for-query-term-containing-hyphens/241471
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [July 16, 2020, 1:51pm UTC](https://discuss.elastic.co/t/watcher-searching-for-query-term-containing-hyphens/241471 "2020-07-16T13:51:35Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ChequredFlag](https://avatars.discourse-cdn.com/v4/letter/c/b2d939/32.png) [@ChequredFlag](https://discuss.elastic.co/u/ChequredFlag)
#### Post date: [July 16, 2020, 1:51pm UTC](https://discuss.elastic.co/t/watcher-searching-for-query-term-containing-hyphens/241471/1 "2020-07-16T13:51:35Z")

</div>

Hi

I am trying to return the number of errors reported against a specific application in our stack. The search term i am using is

```auto
        "search" : {
            "request" : { 
                "indices" : "development-*",
                "body" : {
                    "query" : {
                        "bool" : {
                            "must" : [
                                {
                                    "match" : {"apigw.log_level": "ERROR"}
                                },
                                {
                                    "match" : {"message": 
                                      {
                                        "query": "ab-p-some-api*",
                                        "operator" : "and",
                                        }
                                    }
                                },
                                {
                                    "match" : {"tags": "apigw"}
                                }
                            ],
                            "filter" : {
                                "range" : {
                                    "@timestamp" : {
                                        "from" : "now-5m",
                                        "to" : "now"
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    },

```

however, it returns more results than i am expecting due to the hyphens in the query string being ignored.

Can anyone advise how i make the script check on the exact query string which will be appended by the api version hence the `*` at the end of the `ab-p-some-api*` string

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 23, 2020, 8:48am UTC](https://discuss.elastic.co/t/watcher-searching-for-query-term-containing-hyphens/241471/2 "2020-07-23T08:48:59Z")

</div>

If you do not have any special mapping, a hyphen gets removed by default before data is stored in the inverted index, see this example

```auto
GET _analyze
{
  "text": "one-two-three"
}

```

returns

```auto
{
  "tokens" : [
    {
      "token" : "one",
      "start_offset" : 0,
      "end_offset" : 3,
      "type" : "<ALPHANUM>",
      "position" : 0
    },
    {
      "token" : "two",
      "start_offset" : 4,
      "end_offset" : 7,
      "type" : "<ALPHANUM>",
      "position" : 1
    },
    {
      "token" : "three",
      "start_offset" : 8,
      "end_offset" : 13,
      "type" : "<ALPHANUM>",
      "position" : 2
    }
  ]
}

```

If you want to keep those hyphens, you should take some time and read about analysis in Elasticsearch.

The next minor version of elasticsearch will also feature a [wildcard datatype](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/wildcard.html) that could help you here.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2020, 8:49am UTC](https://discuss.elastic.co/t/watcher-searching-for-query-term-containing-hyphens/241471/3 "2020-08-20T08:49:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.