Search query language

Introduction

The search query language is used to specify conditions on documents that have to be returned as results when searching the archive.

All search conditions can be negated using the NOT keyword. The keyword is case-sensitive, so it must always be written in UPPERCASE. The exclamation mark ! is a shorter version of the NOT keyword and has the exact same function.

NOT operator

The syntax may look as follows.

Freetext search

• NOT value
• !value

Property search

• Subject:(NOT test)
• Subject:(!test)

The NOT operator can also be combined with:

• Phrase queries: NOT "this is a test"
• Regex queries: filename:(NOT **\*\*[0-9]{3}.txt)
• Wildcard queries: NOT test*
• Range queries: Size:(NOT 1M,2M) or Date:(NOT 2020-01-01,2020-12-31)

Search query language categories

The search query language used in any user interface of contentACCESS can be divided into the following categories:

• Source specification
• Property value specification
• Boolean queries
• Regular expressions
• Properties in different archives

Source specification

The searching user can specify where to search on different levels:

• Tenant
• Model
• Entity

Tenant

Tenant:(string) – selects a tenant by name and searches in tenants having the specified string in the name.

MTID

MTID:(string) – selects a model by type identifier.

The following model type identifiers are supported:

• EmailArchive
• FileSystemArchive
• SharePointArchive
• TeamsArchive
• TeamsChatArchive

Source

Source:(string) – selects a model by keyword and searches in models having the specified string as a keyword, such as email, file, or sharepoint.

This is similar to the MTID specification, but accepts a more flexible model specification.

Possible values are:

• FileSystemArchive: archive, file, fs, filesystem
• EmailArchive: archive, email, mail, mailarchive, emailarchive
• GDPR Application: application, db, database, gdpr
• GDPR Exchange: exchange, gdpr, mail, email
• GDPR FileSystem: file, fs, filesystem, gdpr
• OneDriveArchive: onedrive, oneoriveorchive
• SharePointArchive: archive, sharepoint, sharepointarchive, sp
• Sharing: sharing, share, sharedfiles
• TeamsArchive: archive, teams, teamsarchive, tea
• TeamsChatArchive: archive, teams, chat, teamschat, teamschatarchive, tca

Examples:

• source:file
• source:mail

It is also possible to exclude models from the search with the NOT keyword or the exclamation mark !.

For example, when searching everywhere, you can exclude the Email archive by adding the condition Source:(NOT email). The Email archive will then be excluded from the search.

Examples:

• Source:(NOT email) – excludes the Email archive from the search.
• Source:(!file) "pride and prejudice" – the search result list will contain only items that meet the condition.
• Source:(NOT teams) source:(!sharing) – excludes the Teams, Teams Chat archive, and Sharing models from the search.
• Source:(!sharing) AND Title:("The Picture of Dorian Gray.docx") – displays only items with the title The Picture of Dorian Gray.docx and excludes items from the Sharing model.
• Source:(NOT sharing) Source:(!teams) AND FileName:(!"titanic.pptx") – excludes the selected models and item from the search.
• Source:(NOT chat) Source:(NOT file) Source:(NOT email) Source:(NOT sharing) Source:(!sharepoint) – excludes these models from the search results.

Entity

Entity:(string) – selects one or more entities by name and searches in entities having the specified string in the name.

The entity name is the mailbox address in Email archive and the root folder path in File system archive.

Examples:

• entity:john.smith@tech-arrow.com – searches in John Smith's mailbox.
• entity:c:\temp – searches in the c:\temp folder.

Users can also exclude entities from the search by using the NOT keyword. For example, if a user has access to multiple entities within the models, such as mailboxes or root folders, one or more of these entities can be excluded when searching everywhere.

Example:

Source:(email) AND Entity:(NOT *@internal.com)

This searches in the Email archive but excludes the specified mailboxes.

Examples:

• Source:(filesystem) Entity:(NOT *foldersharing) – the search result list will contain only the File system model and will exclude the root connection fitting the condition.
• Source:(email) AND Entity:(!*internal.com) – excludes the internal.com mailboxes from the search.
• Source:(email) AND Entity:(!emily) – excludes Emily's mailbox from the search in the Email archive.
• Entity:(NOT emily.bronte) – excludes entities displayed or used in this format, for example in Sharing and Email archive.
• Entity:(NOT Emily Bronte) – excludes entities displayed in this format, for example in Teams Chat archive and OneDrive.

Property value specification

The following properties can be used to specify conditions on documents to be returned as results when searching the archive.

Date

The Date property is applicable only to properties of the date type.

The exact date specification must use the YYYY-MM-DD format. Hours, minutes, and seconds cannot be specified.

Examples:

• date:(2016-12-05) – searches for items only from the specified day, in this case 5 December 2016.
• date:(2016-12) – searches only for items from the specified month, in this case December 2016.
• date:(2016) – searches for items from the whole year 2016.

Date intervals can also be specified:

• date:(>2016-12) – searches for items newer than December 2016.
• date:(<2019-11-10) – searches for items older than 10 November 2019.
• date:(2017-10, 2017-12) – searches for items created from October 2017 to December 2017.

Available placeholders:

• now – means this hour
• today
• yesterday
• this week
• last week
• this month
• last month
• this year
• last year

Examples:

• date:(now)
• date:(last week)

Number

Numbers are written as usual (1, 2, 3, and so on).

For size conditions, units can also be specified:

• K | KB – size in kilobytes
• M | MB – size in megabytes
• G | GB – size in gigabytes
• T | TB – size in terabytes

Example:

• size:(>1K) – files or emails, depending on the archive, larger than 1 KB.

Range

Two types of ranges can be specified:

• Numerical ranges
• Date ranges

Ranges can be an upper bound, a lower bound, or an interval. A range can be specified as a value for all properties of the date and number types.

• Prop:(>value) – the value of property Prop is greater than value.
• Prop:(<value) – the value of property Prop is less than value.
• Prop:(value1,value2) – the value of property Prop is greater than value1 and less than value2.

Examples:

• size:(1K,1M) – files or emails, depending on the archive, larger than 1 KB and smaller than 1 MB.
• date:(2016-10,2016-12) – files created or modified, or emails sent, depending on the archive, in the last quarter of 2016.

Filename

The Filename property finds items by attachment name in the Email archive or by file name in the File archive.

Wildcard characters * and ? can be used for filename pattern specification. They have the same meaning as when searching for files in Windows.

• Filename:(*.txt) – finds all attachments and files having the .txt extension.
• Filename:(file) – finds attachments and files having the exact name file.
• Filename:(file.*) – finds attachments and files named file with any extension.

Text

Properties with text values can be searched for a single term or phrase or multiple terms and phrases.

Results of a single-term search contain documents having the specified term in the text value of the specified property.

Results of a multi-term search contain documents having all of the specified terms in the text value of the specified property, in any order.

Examples:

• Subject:(lemon) – finds emails having the term lemon in their subject.
• Subject:(lemon orange) – finds emails having the terms lemon and orange anywhere in their subject.

Phrases must be enclosed in double quotation marks. Results of a phrase search contain items having all of the specified terms in the text value of the specified property, in the specified order.

Example:

• Subject:("John Smith") – finds emails having the name John Smith in their subject in the specified order.

Character escaping

The following characters have special meaning in the query syntax:

• (
• )
• "
• :

They cannot be used directly in search terms. They have to be escaped using a backslash \; otherwise, the search query can be ambiguous and produce unexpected results.

Examples:

• Subject:(apple \(pear\)) – finds emails having the terms apple and pear in their subject.
• 8\:00 – finds documents containing the text 8:00.
• Folder:(\*Documents\(1\)\*) – finds documents located in the Documents(1) folder.

Boolean queries

A Boolean query is a search type that allows you to combine desired keywords with operators such as AND and OR to obtain more specific results.

Operator AND

The AND operator narrows the search to items containing all the words separated by the operator.

Every blank space has the same meaning as the AND operator.

Both of the following examples produce the same result:

• content AND access AND email AND archive
• content access email archive

Operator OR

The OR operator expands the search by connecting multiple phrases.

The OR operator means that at least one of the entered phrases must be present. The search returns results containing one, two, three, or all of the selected phrases.

Example:

• content OR access – finds all items containing content, access, or content access.

Grouping

Multiple terms or clauses can be grouped using parentheses () to form subqueries.

Example:

• (email OR file) AND archive – the returned results must contain at least one of the following: email archive or file archive.

Regular expressions

A regular expression (regexp) is a sequence of characters defining a search pattern. This pattern is often used to find or find and replace strings.

Regular expressions can be specified in a search query by using a double-asterisk prefix:

**<regular-expression-pattern>

Regular expressions can be used for property queries as well as free-text queries.

Standard operators

Anchoring

It is possible to define the start and end of a string for a regular expression pattern, but it needs to be anchored specifically.

The ^ symbol indicates the beginning, while the $ symbol indicates the end.

Patterns are always anchored by default. The provided pattern must match the entire string.

For example, for the string abcde:

• ab.* = match
• abcd = no match

Allowed characters

Any Unicode character may be used in the pattern, but there are some exceptions that are reserved and must be escaped.

The standard reserved characters are:

• .
• ?
• +
• *
• |
• {
• }
• [
• ]
• (
• )
• "

If you enable optional features described in this section, the following characters may also be reserved:

• #
• @
• &
• <
• >
• ~

info

Note: Any reserved character can be escaped using a backslash \, including a backslash character itself.

Any character, except double quotes, is interpreted literally when bounded by double quotes.

Example:

• john"@smith.com"

Match any character

The period symbol . can be used to represent any character.

The string abcde can be found as follows:

• ab... = match
• a.c.e = match

Once or more

The plus symbol + can be used to repeat the preceding pattern one or multiple times.

The string aaabbb can be found as follows:

• a+b+ = match
• aa+bb+ = match
• a+.+ = match
• aa+bbb+ = match

Zero or more times

The asterisk symbol * can be used to match the preceding pattern zero or more times.

The string aaabbb can be found as follows:

• a*b* = match
• a*b*c* = match
• .*bbb.* = match
• aaa*bbb* = match

Zero times or once

The question mark ? makes the preceding pattern optional, so it can match zero times or once.

The string aaabbb can be found as follows:

• aaa?bbb? = match
• aaaa?bbbb? = match
• .....?.? = match
• aa?bb? = no match

Minimum to maximum

Curly brackets {} can be used to specify the minimum and maximum number of times the preceding shortest pattern can be repeated.

The allowed forms are:

• {5} – the pattern repeats exactly 5 times.
• {2,5} – the pattern repeats 2 to 5 times.
• {2,} – the pattern repeats at least twice.

For the string aaabbb, the following applies:

• a{3}b{3} = match
• a{2,4}b{2,4} = match
• a{2,}b{2,} = match
• .{3}.{3} = match
• a{4}b{4} = no match
• a{4,6}b{4,6} = no match
• a{4,}b{4,} = no match

Grouping

Parentheses () can be used to form sub-patterns.

The quantity operators listed above operate on the shortest preceding pattern, which can also be a group.

For the string ababab, the following applies:

• (ab)+ = match
• ab(ab)+ = match
• (..)+ = match
• (...)+ = no match
• (ab)* = match
• abab(ab)? = match
• ab(ab)? = no match
• (ab){3} = match
• (ab){1,2} = no match

Alternation

The pipe symbol | works the same as the OR operator mentioned above.

The match is successful if the pattern on either the left side or the right side matches. Alternation applies to the longest pattern.

For the string aabb, the following applies:

• aabb|bbaa = match
• aacc|bb = no match
• aa(cc|bb) = match
• a+|b+ = no match
• a+b+|b+a+ = match
• a+(b|c)+ = match

Character classes

Ranges of characters may be specified as character classes by enclosing them in square brackets [].

A leading ^ symbol negates the character class.

The following forms are allowed:

• [abc] = a, b, or c
• [a-c] = a, b, or c
• [-abc] = -, a, b, or c
• [abc-] = -, a, b, or c
• [^abc] = any character except a, b, or c
• [^a-c] = any character except a, b, or c
• [^-abc] = any character except -, a, b, or c
• [^abc-] = any character except -, a, b, or c

info

Note: The dash - indicates a range of characters, except when it is the first character or when it is escaped with a backslash.

For the string abcd, the following applies:

• ab[cd]+ = match
• [a-d]+ = match
• [^a-d]+ = no match

Optional operators

Complement

Complement is probably the most used and helpful option.

The shortest pattern that comes after a tilde symbol ~ is negated.

For example, ab~cd means:

• Starts with a.
• a is followed by b.
• b is followed by a string of any length containing anything except c.
• Ends with d.

For the string abcdef, the following applies:

• ab~df = match
• ab~cf = match
• ab~cdef = no match
• a~(cb)def = match
• a~(bc)def = no match

Interval

The interval option enables the use of numeric ranges.

The ranges must always be enclosed by angle brackets < >.

For the string access90, the following applies:

• access<1-100> = match
• access<01-100> = match
• access<001-100> = no match

Intersection

The ampersand symbol & joins two patterns. Both patterns have to match the string.

For the string aaabbb, the following applies:

• aaa.+&.+bbb = match
• aaa&bbb = no match

Any string

The at sign @ matches any string in its entire length.

This can be combined with intersection and complement in cases where you want to search for everything except something.

Example:

• @&~(content.+) finds everything except strings beginning with content.

Properties in different archives

When specifying a Boolean value for a property in a query, the following notations can be used:

• true | yes | y – stand for True.
• false | no | n – stand for False.

Property names and values are not case-sensitive.

Wildcard characters * and ? can be used everywhere.

The character | means an option or alternative when multiple property names or values can be used.

If the value is specified in quotes, for example "value", it is considered a phrase.

Example:

• "brown fox" – finds all documents that contain the words brown followed by the word fox.

Email properties

The following properties are applicable when searching in the Email archive.

Property	Specificity	Description
Title | Subject:	(string)	Condition on the email subject.
Sender | From:	(string)	Condition on the email's owner.
To:	(string)	Condition on the email's recipient.
Folder:	(string)	Condition on the folder path; emails can be found only in the specified folder. Backslash is used as the path separator, for example Inbox\Important.
HasAttachment:	true | false	If true, finds emails having one or more attachments; if false, finds emails having no attachments.
Body:	(string)	Search in the mail's body text.
Attachment:	(string)	Search in the mail's attachment text.
MessageClass:	(string)	Condition on the type of email item, such as IPM.note for email or IPM.appointment for a calendar item. The user can get this information directly from the mailbox in Outlook or from the database.
InternetMessageID:	(string)	Search with the email's Internet message ID. The user can get this information from the database.
Date | SentDate:	(date)	Condition on the email's sent date.
ReceivedDate:	(date)	Condition on the receiving date.
Cc:	(string)	Condition on addresses in the CC field of the email.
Bcc:	(string)	Condition on addresses in the BCC field of the email.
Importance:	Low | Normal | High	Finds emails with the specified importance level.
Sensitivity:	Normal | Personal | Private | Confidential	Finds emails with the specified sensitivity level.
Size:	(number)	Condition on the email's size in bytes.
Category:	(string)	Condition on the category.
Flag:	true | false	Finds emails having a flag set (true) or not set (false).
IsInPlaceArchive | IsFromArchive:	true | false	Finds emails from In-Place Archive (true) or emails not from the In-Place Archive (false).
Inactive:	true | false	Finds inactive emails (true) or active emails (false).
Retention:	(number)	Condition on retention time in months.

File properties

The following properties are applicable when searching in the File archive.

Property	Specificity	Description
CreationDate:	(date)	Condition on the file's creation date.
Date | ModifiedDate:	(date)	Condition on the file's modification date.
Folder:	(string)	Condition on the file's path. Backslash is used as the path separator, as in Windows, for example c:\documents\rfa.
Title | Filename:	(string)	Condition on the file's name.
Size:	(number)	Condition on the file's size in bytes.
Inactive:	true | false	Finds inactive files (true) or active files (false).

GDPR Application properties

The following properties are applicable when searching in the GDPR Application.

Property	Specificity	Description
Title:	(string)	Condition on the file's name.
DataSource:	(string)	Condition on the item's source, such as Email or FSItem.

GDPR Exchange properties

The following properties are applicable when searching in GDPR Exchange.

Property	Specificity	Description
Title | Subject:	(string)	Condition on the email subject.
Sender | From:	(string)	Condition on the email's owner.
To:	(string)	Condition on the email's recipient.
Folder:	(string)	Condition on the folder path; emails can be found only in the specified folder. Backslash is used as the path separator, for example Inbox\Important.
HasAttachment:	true | false	If true, finds emails having one or more attachments; if false, finds emails having no attachments.
Body:	(string)	Search in the mail's body text.
Attachment:	(string)	Search in the mail's attachment text.
MessageClass:	(string)	Condition on the type of email item, such as IPM.note for email or IPM.appointment for a calendar item. The user can get this information directly from the mailbox in Outlook or from the database.
InternetMessageID:	(string)	Search with the email's Internet message ID. The user can get this information from the database.
Date | SentDate:	(date)	Condition on the email's sent date.
ReceivedDate:	(date)	Condition on the receiving date.
Cc:	(string)	Condition on addresses in the CC field of the email.
Bcc:	(string)	Condition on addresses in the BCC field of the email.
Importance:	Low | Normal | High	Finds emails with the specified importance level.
Sensitivity:	Normal | Personal | Private | Confidential	Finds emails with the specified sensitivity level.
Size:	(number)	Condition on the email's size in bytes.
Category:	(string)	Condition on the category.
Flag:	true | false	Finds emails having a flag set (true) or not set (false).

GDPR File system properties

The following properties are applicable when searching in the GDPR File system.

Property	Specificity	Description
CreationDate:	(date)	Condition on the file's creation date.
Date | ModifiedDate:	(date)	Condition on the file's modification date.
Folder:	(string)	Condition on the file's path. Backslash is used as the path separator, as in Windows, for example c:\documents\rfa.
Title | Filename:	(string)	Condition on the file's name.
Size:	(number)	Condition on the file's size in bytes.

OneDrive document properties

The following properties are applicable when searching in the OneDrive archive.

Property	Specificity	Description
Name:	(string)	Condition on the document name.
Title:	(string)	Condition on the document title.
CreationDate:	(date)	Condition on the creation date.
Date | ModifiedDate:	(date)	Condition on the modification date.
ModifiedBy:	(string)	Condition on the user who modified the document.
CreatedBy:	(string)	Condition on the user who created the file.
Size:	(number)	Condition on the file size.
URL:	(number)	Condition on the document's URL.
IsActive:	true | false	Finds inactive files (true) or active files (false).
Attachment:	(number)	Search in the file's attachment text or title.

SharePoint document properties

The following properties are applicable when searching in the SharePoint archive.

Property	Specificity	Description
Name:	(string)	Condition on the document name.
Title:	(string)	Condition on the document title.
CreationDate:	(date)	Condition on the creation date.
Date | ModifiedDate:	(date)	Condition on the modification date.
ModifiedBy:	(string)	Condition on the user who modified the document.
CreatedBy:	(string)	Condition on the user who created the file.
Size:	(number)	Condition on the file size.
URL:	(number)	Condition on the document's URL.
IsActive:	true | false	Finds inactive files (true) or active files (false).
Attachment:	(number)	Search in the file's attachment text or title.

Sharing properties

The following properties are applicable when searching in Sharing.

Property	Specificity	Description
DownloadLimit:	(string)	The download limit of the shared files.
ExpirationDate:	(date)	The shared item's expiration date.
FileName:	(string)	The title of the shared document.
Recipient:	(string)	Condition on the shared item's recipient.
Sharedby:	(string)	Name of the user who shared the item.
SharedOn:	(date)	The date when an item was shared.
Status:	(string)	Type of the status. Possible values are Active, Suspended, and Expired. The Unavailable status cannot be searched for.

Teams archive properties

The following properties are applicable when searching in the Teams archive.

Property	Specificity	Description
Title:	(string)	Message title.
Date | CreationDate:	(date)	Message's sent date.
Author | Sender:	(string)	The user who sent the message.
Channel | ChannelName:	(string)	The Teams channel the message was sent to.
Folder | Location | Path | Url:	(string)	Specifies the channel name or attachment location (SharePoint document URL).
Mentioned:	(string)	Name of the mentioned user.
Reacted:	(string)	Name of the user who sent a reaction.
ReactedOn:	(date)	The date when a reaction was sent.
Reaction:	(string)	Type of the reaction. Possible values are Like, Angry, Sad, Laugh, Heart, and Surprised.
Attachment:	(string)	Attachment name and content.
HasAttachment:	(boolean)	Indicates whether the message has an attachment.
Type:	(string)	Type of the item. Possible values are Message (normal chat message), Reply (reply to a message), and File (attachment file or file on Teams-related SharePoint sites).
URL:	(string)	Condition on the document's URL (SharePoint document URL).
Body:	(string)	Search in the message's body text.
Inactive:	true | false	Finds inactive messages (true) or active messages (false).
Size:	(number)	Message size, including attachments.
FileName:	(string)	Attachment name.
Subject:	(string)	Subject of the email message posted to a channel.

Teams chat archive properties

The following properties are applicable when searching in the Teams chat archive.

Property	Specificity	Description
Title:	(string)	Message title.
Date | CreationDate:	(date)	Message's sent date.
Author | Sender:	(string)	The user who sent the message.
Mentioned:	(string)	Name of the mentioned user.
Reacted:	(string)	Name of the user who sent a reaction.
ReactedOn:	(date)	The date when a reaction was sent.
Reaction:	(string)	Type of the reaction. Possible values are Like, Angry, Sad, Laugh, Heart, and Surprised.
Attachment:	(string)	Attachment name and content.
HasAttachment:	(boolean)	Indicates whether the message has an attachment.
Folder | Category:	(string)	Specifies the message category. Valid values are Chats, Group chats, or Meetings.
Body:	(string)	Search in the message's body text.
Inactive:	true | false	Finds inactive messages (true) or active messages (false).
Size:	(number)	Message size, including attachments.
FileName:	(string)	Attachment name.
Member:	(string)	Name of the user who is a member of a chat.
Topic:	(string)	Topic of a meeting.