When Query string contains hyphen characters, hyphen characters will be ignored

[Jerry163 (Jerry)]

I want to filter the error logs starting with "ORA-" in the Oracle Alert log, but when I use the query expression of message: "ORA-*" to filter, many strings starting with ORA are also matched, hyphen characters will be ignored.

Escape the hyphen with a backslash and get the same number of results, Please tell me how to deal with it

[dadoonet (David Pilato)]

Welcome!

It's an analysis problem.

Please take some time to understand this by reading a bit Text analysis | Elasticsearch Guide [8.12] | Elastic

Here, to sum up the behavior, the text "ORA-27102" is analyzed to ["ora", "27102"] and index like this.
At search time, the text ORA- is analyzed to ["ora"] which matches every token ora.

[Jerry163 (Jerry)]

Thanks for such a quick reply.After I modified the index to use the whitespace tokenizer, I can now search through ORA-*. Thank you very much for your help.