Impossible to search for documents containing "??" in a property

[jeremycohensolal]

Hello

I want to retrieve all documents containing IPCOUNTRY=?? but it doesn't work.

I tried in discover the following

• IPCOUNTRY:?? => ? is evaluated > returns all records > normal case-
• IPCOUNTRY:?? => Doesn't return any document... but lucene documentation says it should be the good way of achieving this...
• IPCOUNTRY:"??" => doesnt work
• IPCOUNTRY:'??' => doesnt work
• IPCOUNTRY:/[^A-Z]{2}/

The strange thing is that

• exists:_type AND IPCOUNTRY:?? => returns all documents but IPCOUNTRY:?? returns nothing...

My ELK stack is :

• KIBANA: Version 4.4.1 / Build 9693
• ELASTICSEARCH: Version 2.2.0

[rashidkpc]

This is an elasticsearch mapping issue. Punctuation is dropped. You'll need to set your field to an analyzer that would keep ?. Maybe keyword? or not_analyzed?

[jeremycohensolal]

in fact this doesnt seems to be dropped, when I display all IPCOUNTRY parameters, I can see "??" when some records have unknown IP

But I am unable to create a filter for this value. Do you think I still have to change the analyzer?