Search query language

Introduction

The contentACCESS search query language allows users to specify conditions that documents must meet to be returned as search results. Search conditions can be used to narrow searches by source, document properties, dates, numbers, ranges, filenames, and archive-specific properties.

Negating search conditions

All search conditions can be negated using the NOT keyword. The keyword is case sensitive and must always be written in UPPERCASE.

The exclamation mark ! is a shorter version of the NOT keyword and has the same function.

Freetext search

• NOT value
• !value

Property search

• Subject:(NOT test)
• Subject:(!test)

The NOT operator can also be combined with the following query types:

• Phrase queries: NOT "this is a test"
• Regex queries: filename:(NOT **[0-9]{3}.txt)
• Wildcard queries: NOT test*
• Range queries: Size:(NOT 1M,2M) OR Date:(NOT 2020-01-01,2020-12-31)

Search query categories

The search query language used in contentACCESS user interfaces can be divided into the following categories:

• Source specification
• Property value specification
• Date values
• Number values
• Ranges
• Filename conditions
• Archive-specific properties

Source specification

The searching user can specify where to search on different levels:

• Tenant
• Model
• Entity

Tenant

Tenant:(string) selects a tenant by name. The search is performed in tenants whose name contains the specified string.

MTID

MTID:(string) selects a model by type identifier.

The following model type identifiers can be used:

• EmailArchive
• FileSystemArchive
• SharePointArchive

Source

Source:(string) selects a model by keyword. The search is performed in models having the specified string as a keyword.

This is similar to MTID, but allows a more flexible model specification.

Possible values include:

• For FileSystemArchive: file, fs, filesystem, archive
• For EmailArchive: archive, email, mail, mailarchive, emailarchive

Examples:

• source:file
• source:mail

Entity

Entity:(string) selects one or more entities by name. The search is performed in entities whose name contains the specified string.

The entity name is:

• The mailbox address in Email archive.
• The Root folder path in File system archive.

Examples:

• entity:abal@tech-arrow.com – searches in ABAL's mailbox.
• entity:c:temp – searches in the c:temp folder.

Property value specification

The following property types can be used to specify conditions on documents that should be returned as search results.

Date

The Date property type is applicable only to properties of the date type.

An exact date must be specified in the YYYY-MM-DD format. Hours, minutes, and seconds cannot be specified.

Example:

• date:(2016-12-05)

The following placeholders are available:

• now – means this hour.
• today
• yesterday
• this week
• last week
• this month
• last month
• this year
• last year

Examples:

• date:(now)
• date:(last week)

Number

Numbers are written as usual, for example 1, 2, or 3.

For size conditions, the following units can also be specified:

• K | KB – size in kilobytes.
• M | MB – size in megabytes.
• G | GB – size in gigabytes.
• T | TB – size in terabytes.

Example:

• size:(>1K) – finds files or emails, depending on the archive, larger than 1 KB.

Range

Two types of ranges can be specified:

• Numerical ranges.
• Date ranges.

Ranges can specify an upper bound, lower bound, or interval. A range can be specified as a value for all properties of the date and number types.

• Prop:(>value) – the value of property Prop is greater than value.
• Prop:(<value) – the value of property Prop is less than value.
• Prop:(value1,value2) – the value of property Prop is greater than value1 and less than value2.

Examples:

• size:(1K,1M) – finds files or emails, depending on the archive, larger than 1 KB and smaller than 1 MB.
• date:(2016-10,2016-12) – finds files created or modified, or emails sent, depending on the archive, in the last quarter of 2016.

Filename

The Filename property finds items by attachment name in an Email archive or by file name in a File archive.

Wildcard characters can be used to specify filename patterns:

• *
• ?

These have the same meaning as when searching for files in Windows.

Examples:

• Filename:(*.txt) – finds all attachments and files with the .txt extension.
• Filename:(file) – finds attachments and files with the exact name file.
• Filename:(file.*) – finds attachments and files named file, regardless of their extension.

General query rules

When specifying a boolean value for a property, the following notations can be used:

• true | yes | y – stand for True.
• false | no | n – stand for False.

Property names and values are not case sensitive.

Wildcard characters (* and ?) can be used everywhere.

The character | means an option or alternative when multiple property names or values can be used.

If a value is enclosed in quotes, for example "value", it is considered a phrase.

Example:

• "brown fox" finds all documents containing the word brown followed by the word fox.

Email archive properties

The following properties are applicable when searching in an Email archive.

Property	Specificity	Description
HasAttachment:	true | false	If true, finds emails having one or more attachments; if false, finds emails having no attachments.
Importance:	Low | Normal | High	Finds emails with the specified importance level.
Sensitivity:	Normal | Personal | Private | Confidential	Finds emails with the specified sensitivity level.
Flag:	true | false	Finds emails having a flag set (true) or not set (false).
AttachmentCount:	(number)	Finds emails with the specified attachment count.
Bcc:	(string)	Condition on addresses in the BCC tag of the email.
Category:	(string)	Condition on category.
Cc:	(string)	Condition on addresses in the CC tag of the email.
Folder:	(string)	Condition on folder path; emails can be found only in the specified folder. A backslash is used as the path separator, for example Inbox\Important.
ReceivedDate:	(date)	Condition on receiving date.
RetentionTime:	(number)	Condition on retention time in months.
Sender | From:	(string)	Condition on email sender.
Date | SentDate:	(date)	Condition on the email's sent date.
Size:	(number)	Condition on email size in bytes.
Title | Subject:	(string)	Condition on email subject.
To:	(string)	Condition on email recipient.
Body:	(string)	Searches in the mail's body text.
Attachment:	(string)	Searches in mail attachment text.

File archive properties

The following properties are applicable when searching in a File archive.

Property	Specificity	Description
CreationDate:	(date)	Condition on file creation date.
Title | Filename:	(string)	Condition on file name.
Folder:	(string)	Condition on file path. The path separator is the same as in Windows, for example c:\documents\rfa.
Date | ModifiedDate:	(date)	Condition on file creation date.
Size:	(number)	Condition on file size in bytes.

SharePoint document properties

The following properties are applicable when searching in a SharePoint archive.

Property	Specificity	Description
CreatedBy:	(string)	Condition on the user who created the file.
CreationDate:	(date)	Condition on creation date.
FileSize:	(number)	Condition on file size.
Date | ModificationDate:	(date)	Condition on modification date.
ModifiedBy:	(string)	Condition on the user who modified the document.
Name:	(string)	Condition on document name.
Title:	(string)	Condition on document title.
VersionNum:	(number)	Condition on document version number.

OneDrive document properties

The following properties are applicable when searching in a OneDrive archive.

Property	Specificity	Description
CreationDate:	(date)	The creation date of the file.
All text:	(string)	File content and metadata.
Extension:	(string)	The extension must also be specified with the dot, such as .txt or .docx.
Filename:	(string)	The name of the file.
Is active (Yes/No):	(string)	The status of the item in the Portal.
ModifiedDate:	(date)	The modification date of the file.
Size:	(number)	The size of the file in bytes.
Path:	(string)	The folder/list path where the item is located.
Url:	(string)	The URL of the file.

GDPR File system job conditions

The following properties are applicable when searching in a GDPR File system archive.

Property	Specificity	Description
All text:	(string)	File content and metadata.
Creation date:	(date)	The creation date of the file.
Extension:	(string)	The extension must also be specified with the dot, such as .jpg, .png, or .pdf.
File name:	(string)	The name of the file.
Modification date:	(date)	The modification date of the file.
Path:	(string)	The folder path of the parent folder where the item is located.
Size:	(number)	The size of the item.

GDPR Exchange job conditions

The following properties are applicable when searching in a GDPR Exchange archive.

Property	Specificity	Description
All text:	(string)	Body, recipients, sender, subject, attachment filenames, and attachment content.
Bcc:	(string)	Condition on addresses in the BCC tag of the email.
Body:	(string)	Searches in the mail's body text.
Category:	(string)	Condition on category.
Cc:	(string)	Condition on addresses in the CC tag of the email.
Folder path:	(string)	Folder path of the parent folder where the item is located.
Has attachment:	true | false	If true, finds emails having one or more attachments; if false, finds emails having no attachments.
Importance:	Low | Normal | High	Finds emails with the specified importance level.
Message class:	(string)	Condition on message class.
Received date:	(date)	Condition on receiving date.
Recipients:	(string)	Condition on email recipients.
Sender:	(string)	Condition on email sender.
Sensitivity:	Normal | Personal | Private | Confidential	Finds emails with the specified sensitivity level.
Sent date:	(date)	Condition on email's sent date.
Size:	(number)	The size of the item.
Subject:	(string)	Condition on email subject.
To:	(string)	Condition on email recipient.

Teams archive job conditions

The following properties are applicable when searching in a Teams archive.

Property	Specificity	Description
All text:	(string)	File name, file content, subject of the post, and content of the post.
Archive date:	(date)	The archivation date of files and posts in the TEA Recovery, Retention changer, and Delete jobs.
Author:	(string)	Condition on author.
Channel name:	(string)	Filters Teams channels by title.
Creation date:	(date)	The creation date of files and posts.
Extension:	(string)	The extension must also be specified with the dot, such as .jpg, .png, or .pdf.
File name:	(string)	The name of the file.
Has attachment:	Yes | No	Condition on attachment presence.
Importance:	Standard | Important | Urgent	Condition on importance level.
Is active:	Yes | No	The status of the item in the Portal.
Is message:	Yes | No	Condition on whether the item is a message.
Is private:	Yes | No	Filters out private channels.
Is replied:	Yes | No	Applicable in the TEA Recovery, Retention changer, and Delete jobs.
Modification date:	(date)	The modification date of files and posts.
Retention category:	(string)	Applicable in the TEA Recovery, Retention changer, and Delete jobs.
Sender:	(string)	Condition on sender.
Size:	(number)	The size of the item.
Storage:	(string)	Applicable in the TEA Recovery, Retention changer, and Delete jobs.
URL:	(string)	The URL of the item.

Teams chat archive job conditions

The following properties are applicable when searching in a Teams chat archive.

Property	Specificity	Description
All text:	(string)	File name, file content, and message content.
Creation date:	(date)	The creation date of messages, chats, and files.
Has attachment:	Yes | No	Condition on attachment presence.
Importance:	Standard | Important | Urgent	Condition on importance level.
Is active:	Yes | No	The status of the item in the Portal.
Members:	(string)	The names of members or chat partners.
Modification date:	(date)	The modification date of messages, chats, and files.
Sender:	(string)	Condition on sender.
Topic:	(string)	The name (title) of group chats, for example HR team.
Type:	Private | Group | Meeting	Condition on chat type.