# When Query string contains hyphen characters, hyphen characters will be ignored

**URL:** https://discuss.elastic.co/t/when-query-string-contains-hyphen-characters-hyphen-characters-will-be-ignored/355039
**Category:** Elasticsearch
**Created:** [March 8, 2024, 1:12pm UTC](https://discuss.elastic.co/t/when-query-string-contains-hyphen-characters-hyphen-characters-will-be-ignored/355039 "2024-03-08T13:12:16Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Jerry163](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerry163/32/124897_2.png) [@Jerry163](https://discuss.elastic.co/u/Jerry163)
#### Post date: [March 8, 2024, 1:12pm UTC](https://discuss.elastic.co/t/when-query-string-contains-hyphen-characters-hyphen-characters-will-be-ignored/355039/1 "2024-03-08T13:12:16Z")

</div>

I want to filter the error logs starting with "ORA-" in the Oracle Alert log, but when I use the query expression of message: "ORA-\*" to filter, many strings starting with ORA are also matched, hyphen characters will be ignored.

 ![1](https://us1.discourse-cdn.com/elastic/original/3X/9/1/912dc48e57200a1f26b9902cfba1f99a5100d0f5.jpeg)  
Escape the hyphen with a backslash and get the same number of results, Please tell me how to deal with it  
 ![2](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5dc8b38246a336db6cb5060391a2700fc74c1634.jpeg)

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 8, 2024, 3:07pm UTC](https://discuss.elastic.co/t/when-query-string-contains-hyphen-characters-hyphen-characters-will-be-ignored/355039/2 "2024-03-08T15:07:03Z")

</div>

Welcome!

It's an analysis problem.

Please take some time to understand this by reading a bit [Text analysis | Elasticsearch Guide [8.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis.html)

Here, to sum up the behavior, the text `"ORA-27102"` is analyzed to `["ora", "27102"]` and index like this.  
At search time, the text `ORA-` is analyzed to `["ora"]` which matches every token `ora`.

---

<div class="post-metadata">

### Author: ![Jerry163](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerry163/32/124897_2.png) [@Jerry163](https://discuss.elastic.co/u/Jerry163)
#### Post date: [March 9, 2024, 11:30am UTC](https://discuss.elastic.co/t/when-query-string-contains-hyphen-characters-hyphen-characters-will-be-ignored/355039/3 "2024-03-09T11:30:36Z")

</div>

Thanks for such a quick reply.After I modified the index to use the whitespace tokenizer, I can now search through ORA-\*. Thank you very much for your help.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2024, 11:31am UTC](https://discuss.elastic.co/t/when-query-string-contains-hyphen-characters-hyphen-characters-will-be-ignored/355039/4 "2024-04-06T11:31:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.