How to search pattern with colon in elasticsearch?

Question

I have a field in Elasticsearch with the value "ft:05/08/2015 13:01:27.358,cgn:4189" . When I want to search with query string "cgn:4189" i have no result . I try to escape the colon like "cgn:4189" but i have a syntax error . I don't know how to do this .

{"query":{"bool":{"must":[{"query_string":{"default_field":"fluentd.message","query":"cgn:"}}],"must_not":[],"should":[]}},"from":0,"size":10,"sort":[],"facets":{}}

Results :

"error": "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures

And

{"query":{"bool":{"must":[{"query_string":{"default_field":"fluentd.message","query":"cgn\:"}}],"must_not":[],"should":[]}},"from":0,"size":10,"sort":[],"facets":{}}

Results :

JSON.parse: bad escaped character at line 1 column 91 of the JSON data

Can you help me please?

Answer 1

Try this query and see if it works for you:

{
   "query": {
      "bool": {
         "must": [
            {
               "query_string": {
                  "default_field": "fluentd.message",
                  "query": "cgn\\:4189"
               }
            }
         ],
         "must_not": [],
         "should": []
      }
   },
   "from": 0,
   "size": 10,
   "sort": [],
   "facets": {}
}

Here is some Sense code I used to test it:

http://sense.qbox.io/gist/1c90964da37d3dfec47d76288885db5793f38415

If that doesn't work for you, then it probably has something to do with your mapping and/or analysis setup. So if you could post your mapping, including any custom analyzers, in your question it will help. Also, properly formatting your code blocks would make them much easier to read.

Answer 2

Referring to elastic search documentation you can just add escaped double quotes to the query as such:

{
  "query": {
    "query_string" : {
      "query": "ip_addr:\"2001:db8::/48\""
    }
  }
}