How to Use AQS to Construct Complex Discovery Queries
Introduction
Advanced Query Syntax (AQS) is used to create searches that can be used in Discovery Searches. The purpose of this blog is to show how to construct very complex search queries for Discovery Search using AQS.
AQS can also be used in Outlook online mode searches, Outlook cached mode searches, Outlook Web Access (OWA) searches, and file searches of the Windows operating system.
AQS is provided by through the Windows operating system using Windows Desktop Search (WDS). In order to create valid AQS searches, you must create fully qualified searches. Creating a fully qualified search involves adding a parenthesis every time you add a Boolean operator to the search. Boolean operators include AND, OR, and NOT.
Creating Fully Qualified AQS Searches
For example if you wish to search for the word settle and include variants such as settles, settled, and settlement, you can search for the following term:
settle*
The asterisk means that you will be searching for all terms beginning with the root settle. This is called prefix searching. In Exchange 2010 Discovery Search and in Exchange 2010 Service Pack 1 OWA search or later, you must add the asterisk.
In Outlook online mode and earlier versions of Exchange 2010 or Exchange 2007 OWA search, the asterisk is added for you by the system.
If you are not sure if the system is going to do prefix searching by default, you can always add the asterisk to make sure. However, you should avoid adding an asterisk after a very small number of letters or numbers (such as 1 or 2 letters or numbers), as this can bring very large sets of results or even cause the search to fail.
If you wish to search for the terms settle* OR double, because you are adding a Boolean operator, you need to add parentheses to make the search fully qualified:
(settle* OR double)
If you wish to search for the terms entrap* OR lawsuit you would enter the search this way:
(entrap* OR lawsuit)
Let us suppose you wish to find hits for a Discovery search that included the terms settle* OR double and also included the terms suit OR arraign*.
You would enter the search this way - first, place the two expressions next to each other:
(settle* OR double) (suit OR arraign*)
Then, add the logical operator AND:
(settle* OR double) AND (entrap* OR lawsuit)
The rule is that every time you an a Boolean logical operator (AND or OR or NOT), you must add a beginning and closing parentheses.
Since you have introduced a new Boolean operator (AND) to the expression, add a beginning and closing parentheses:
((settle* OR double) AND (entrap* OR lawsuit))
Since you have now created a fully qualified AQS query, the following expression will bring the same results as the query above:
((lawsuit OR entrap*) AND (double OR settle*))
In other words, ((settle* OR double) AND (entrap* OR lawsuit)) is equivalent to ((lawsuit OR entrap*) AND (double OR settle*)) – these searches will give the same results.
However, (settle OR double) and (entrap* OR lawsuit) is not equivalent to (lawsuit OR entrap*) AND (double OR settle*) – these searches will give different results.
The reason that these searches give different results is that in AQS, all queries must be fully qualified. Otherwise, the queries are invalid and will give incorrect results.
Creating Complex Fully Qualified AQS Queries
Remember - the rule in AQS is that every time you wish to add a new Boolean operator such as AND or OR or NOT to a query, you must add a new beginning and a matching ending parenthesis.
The chart below illustrates this principle:
Operators Parentheses Expression
0 0 settle*
1 11 (settle* OR double)
2 211 ((settle* OR double) OR depos*)
3 3111 (((settle* OR double) OR bond) OR depos*)
4 4111 ((((settle* OR double) OR bond) OR depos*) OR appeal*)
5 5111 (( (((settle* OR double) OR bond) OR depos*) OR appeal*) OR aquit)
6 6111 ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) OR aquit) OR brief*)
7 7111 ( ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) OR aquit) OR brief*) OR claim)
8 8111 (( ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) OR aquit) OR brief*) OR claim) OR convict*)
9 9111 ((( ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) OR aquit) OR brief*) OR claim) OR convict*) OR docket)
10 10111 ( ((( ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) OR aquit) OR brief*) OR claim) OR convict*) OR docket) OR inform*)
Group A
Here are two more examples:
Operators Parentheses Expression
0 0 entrap*
1 11 (entrap* OR lawsuit)
2 211 ((entrap* OR lawsuit) OR litigat*)
3 3111 (((entrap* OR lawsuit) OR litigat*) OR trial)
4 41111 ((((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*)
5 511111 (( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) OR affirm)
6 6111111 ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) OR affirm) OR complain*)
7 71111111 ( ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) OR affirm) OR complain*) OR contract)
8 811111111 (( ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) OR affirm) OR complain*) OR contract) OR judg*)
9 911111111 ((( ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) OR affirm) OR complain*) OR contract) OR judg*) OR prejudice)
10 101111111111 ( ((( ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) OR affirm) OR complain*) OR contract) OR judg*) OR prejudice) OR interrogat*)
Group B
Operators Parentheses Expression
0 0 indict*
1 11 (indict* OR insur*)
2 211 ((indict* OR insur*) OR triple)
3 3111 (((indict* OR insur*) OR triple) OR attorney)
4 4111 ((((indict* OR insur*) OR triple) OR attorney) OR dismiss*)
5 5111 ((((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt)
6 6111 ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*)
7 7111 ( ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*) or counsel*)
8 8111 (( ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*) or counsel*) or discover*)
9 9111 ((( ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*) or counsel*) or discover*) or evidence)
10 10111 ( ((( ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*) or counsel*) or discover*) or evidence) or liquidat*)
Group C
Combining Groups of Terms to Create More Complex Queries
If you want to combine terms in a very complex search, you can combine groups and add logical operators.
For example, if you first wish to take all the terms in Group A above and AND those terms with all the terms in Group B above and then you wanted to make sure that none of the terms in Group C would be found in the results combining A AND B, you would be create an expression something like this:
((Group A AND Group B) NOT Group C)
The first step is to add each group separately – we will take expressions with 3 terms each to illustrate:
((settle* OR double) OR depos*) ((entrap* OR lawsuit) OR litigat*) ((indict* OR insur*) OR triple)
Then we add the logical operators:
((settle* OR double) OR depos*) AND ((entrap* OR lawsuit) OR litigat*) NOT ((indict* OR insur*) OR triple)
Then we add the additional parentheses to AND Group A and Group B together to take care of the AND operator between Group A and Group B:
( ((settle* OR double) OR depos*) AND ((entrap* OR lawsuit) OR litigat*) ) NOT ((indict* OR insur*) OR triple)
Then we add the additional parentheses to the entire expression because we are adding the NOT operator
((((settle* OR double) OR depos*) AND ((entrap* OR lawsuit) OR litigat*)) NOT ((indict* OR insur*) OR triple))
Then we add the additional parentheses to AND Group A and Group B together to take care of the AND operator between Group A and Group B:
( ((settle* OR double) OR depos*) AND ((entrap* OR lawsuit) OR litigat*) ) NOT ((indict* OR insur*) OR triple)
Then we add the additional parentheses to the entire expression because we are adding the NOT operator
((((settle* OR double) OR depos*) AND ((entrap* OR lawsuit) OR litigat*)) NOT ((indict* OR insur*) OR triple))
We can do the same thing with 11 terms from each group - the first step is to add each group separately – we will take expressions with 3 terms each to illustrate:
( ((( ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) or aquit) or brief*) or claim) or convict*) or docket) or inform*)
( ((( ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) or affirm) or complain*) or contract) or judg*) or prejudice) or interrogat*)
( ((( ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*) or counsel*) or discover*) or evidence) or liquidat*)
Then we add the logical operators:
( ((( ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) or aquit) or brief*) or claim) or convict*) or docket) or inform*) AND
( ((( ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) or affirm) or complain*) or contract) or judg*) or prejudice) or interrogat*) NOT
( ((( ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*) or counsel*) or discover*) or evidence) or liquidat*)
Then we add the additional parentheses to AND Group A and Group B together to take care of the AND operator between Group A and Group B:
(( ((( ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) or aquit) or brief*) or claim) or convict*) or docket) or inform*) AND
( ((( ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) or affirm) or complain*) or contract) or judg*) or prejudice) or interrogat*)) NOT
( ((( ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*) or counsel*) or discover*) or evidence) or liquidat*)
Then we add the additional parentheses to the entire expression because we are adding the NOT operator
((( ((( ((( (((settle* OR double) OR bond) OR depos*) OR appeal*) or aquit) or brief*) or claim) or convict*) or docket) or inform*) AND
( ((( ((( (((entrap* OR lawsuit) OR litigat*) OR trial) OR defend*) or affirm) or complain*) or contract) or judg*) or prejudice) or interrogat*)) NOT
( ((( ((( (((indict* OR insur*) OR triple) OR attorney) OR dismiss*) or bankrupt) or confirm*) or counsel*) or discover*) or evidence) or liquidat*))
Validating Matching Parentheses in AQS Queries
You can install and use Notepad++ to validate beginning and closing parentheses when creating AQS queries.
Notepad++
https://notepad-plus-plus.org/
Summary and Conclusion
Advanced Query Syntax (AQS) is used to create searches that can be used in Discovery Searches. AQS can also be used in Outlook online mode searches, Outlook cached mode searches, Outlook Web Access (OWA) searches, and file searches of the Windows operating system. AQS is provided by through the Windows operating system using Windows Desktop Search (WDS). In order to create valid AQS searches, you must create fully qualified searches.
Creating a fully qualified search involves adding a parenthesis every time you add a Boolean operator to the search. Boolean operators include AND, OR, and NOT.
In order to create complex valid AQS queries you can use in Discovery Search in Exchange 2010, use the chart above to build queries like the ones in the sample queries given above.
Use Notepad++ to validate beginning and closing parentheses when creating AQS queries.
Bob Want, Senior Support Escalation Engineer, Enterprise Communications Services, Microsoft