If you want to search for a text value (data type: STRING) like eg. name of company, country code, city name, project etc. then normally you have to put the values between quotation marks. If it’s just one word you don’t have to use quotations, you can instead refrain from using quotations:

 project:My/First/Project

You don’t have to use quotations if it’s one word without spaces. However, when you have spaces between the word, it is recommended to use them:

project:”My second project”

If you want to insert a numeric value (data type: STRING) like for example the CNI number of a ticket do as follows:

cni:”5″

Also good to know – always try to use the correct spelling for the queries – otherwise results may not appear.

Incorrect spelling

inwarranty:true

Correct spelling

inWarranty:true

If you want to two or more  values you should use rounded brackets and a connector like AND or OR.

The OR operator displays results with at least one value fulfilled.

affectedCountryCode:(DE OR PL OR GR)

The AND operator displays results with all values fulfilled.

category:(“Break and fix” AND cni.sort:[5 to 8])

If you want to search for a range of tickets you have to use brackets and the word TO as a connector:

appointmentFixedTo:[202105 TO 202110]

The following format is used especially for the date type fields in order for results to be displayed:
YYYYMMDDHHMM = Year, Month, Day, Hours, and Minutes

The shorter format YYYYMMDD or YYYYMM also works for the query search.

Please be advised that searching for ranges only works with the data type date.

If you want to search for tickets in a particular status you can just use the matching query:

status:canceled

Searching for two statuses at once is also easily possible:

status: (CANCELED OR “PENDING WAIT ONSITE”)

You can also use NOT to search for specific filter elements according to the exclusion principle:

NOT status: canceled

You can also search for multiple status at once, just use the correct syntax:

NOT status: (CANCELED OR “PENDING WAIT ONSITE” OR APPOINTMENT)

You can use the simple lsdt query to find tickets for a particular date:

lsdt:20210602

If you want to search for tickets within specific dates you can use the time operators YEAR, HOURS, SECONDS and the query NOW to find the ticket:

lsdt:[NOW-1HOUR]

You can also use mathematical symbols to find a particular set of tickets:

lsdt:<20230602

Above alias will search for tickets that were last updated before the 02.06.2023.
It won’t display tickets after this date.

Please be advised that the technical time is taken, therefore UTC time offset must be added or subtracted in the input for results to be actually displayed.
Example: You are a dispatcher in a UTC+2 time zone and want to find a ticket with a particular LSDT time and date (eg. 01/08/2023 at 08:00).
Instead of typing lsdt:202308010800, you would instead type lsdt:2023080600 to find the desired ticket.

The following mathematical symbols are supported throughout search fields:

<; >; <=

Let’s say you want to find tickets with the help of mathematical symbols.

What you could do in this case is to go by the data type date and using the query lsdt to find only tickets before a selected LSDT.

lsdt:<=20220601

Yes! But just for text and numbers.

Let’s say you want to find tickets with contact persons, where you don’t know the exact spelling. You know the persons’ name starts with a “ki” and ends with a “y”. What you could do in this case is the following:

affectedUser:ki*y

This will display you all tickets with the variation of the name, doesn’t matter if our person is named: Kimchy, Kilaory or Kitty. The search will display them all.

The same principle goes for numbers. Let’s say you don’t know the last digit of the CNI’s so you decide to browse through all of them to find your right ticket.

cni:13*

This will display you all tickets with the CNI numbers between 130 and 139 and the ticket with CNI 13 (because the star doesn’t have to mean a number necessarily).

If you want to search for a ticket with multiple conditions you can use operators as OR, AND; TO or NOT etc. pp.

Be advised that the operator NOT is always put before the alias:

NOT category: “Break and fix”

A more complex combined query example:

category:(“Standard” AND appointmentFixedFrom:[202105 TO 202110])

Another complex combined query example:

category:(“Break and fix” AND cni.sort:[5 to 8])

We currently utilize the following data types in our search.

String: The string data type stores any kind of text data (including numbers).
Boolean: The boolean value  TRUE or FALSE.
Date: Date fields have a predetermined size and format. They can be defined on the definition specification. We use the following specification inside our search: YYYYMMDDHHMM or the shorter one YYYYMMDD or YYYYMM
UUID: Universal Unique Identifier, commonly used for unique IDs (eg. reportingUserId).
Integer: The integer data type stores whole numbers that range from -2147483647 to 2147483647 for 9 or 10 digits of precision.
Double: A double-precision floating-point number is a long floating-point number of 64 bits.

Yes, you can!
If you like a query and you want to use it more frequently you can save it for further usage.
Learn more in the My queries topic.

You can try to find tickets with a specific keyword by just typing a keyword inside the search field.
This can prove particularly useful if for any reason you cannot find a matching query or you just need some fast results.
The Elastic Search will then do it’s best to display results with all tickets that contain your keyword.
Let’s assume you want to find all tickets which have the value “unicorn” somewhere entered:

 unicorn

You can also take this further to find all tickets that particularly do not not contain this value by using the – symbol.

-“unicorn”