Short message search

Short message search allows for a detailed search on RSMF documents by examining message-level metadata. It helps to, for example, identify conversations between specific participants, detect messages that were deleted or edited, track message reactions, and locate messages sent within a specified time period. Once messages are found, message-level coding can be performed on them in the Viewer if necessary.

This workflow uses Elasticsearch to create the short message search index within the workspace. The index must be created before conducting searches. See Short message search index for more information.

Considerations

Before you run a short message search, consider the following regarding message-level conditions:

• are treated as an index search condition.
• cannot be combined with other index search conditions.
• can only be searched with other field conditions using the AND operator.
• can only be used as the first condition within a search. From here, you can run your search, and it will return RSMF documents matching the supplied search criteria.

Creating a short message search

After you build the short message search index, you can search it from the Documents tab. See Short message search index for more information on building the index.

To create a short message search:

1. Navigate to the Documents tab.
2. Click Add Condition in the search panel to add a condition. For more information on the search panel, see Search panel.
   
3. Select (Short Message Search) from the Add Condition fields list.
   The Add Condition - Select Field modal appears.
   
4. Select the desired short message field from the list. See the Searchable fields section for a list of all fields available for short message searches.
   The Filter modal appears. The data entry fields on this modal vary depending on the short message field previously selected.
   
5. On the Filter modal, choose the operator, enter or select query information, and click Apply.
6. Optionally, you can:
   • Add additional conditions by clicking Add Condition and repeating the steps above.
   • Create logic groups to group conditions together by clicking the Add Condition drop-down arrow and selecting Logic Group. Then, drag the conditions into the logic group frames. Use the AND or OR operators to join logic groups. See Setting up search conditions.
     
7. When finished entering search conditions, click Apply on the Short Message Search Conditions modal. The Short Message Search condition card is added to the Search Conditions list.
   
8. Repeat the steps above to add more conditions or logic groups.
9. Click Run Search to start the search if the Auto Run toggle is not enabled. If the toggle is enabled, the search begins automatically.
   After running a search, the Document list displays all the documents with at least one message or event matching the query conditions.
10. Click the document Control Number in the Documents list to view it in the Viewer.

Messages containing a highlight are identified in the Viewer with a yellow highlight around the metadata icon. Navigate to each one by using the Persistent Highlight navigation buttons () on the top toolbar of the Viewer. For more information on the Viewer, see Short Message Viewer

If needed, you can create a saved search on the Documents list as you would any other search. See Saved search and Create a saved search for more information.

Defining search criteria operators

There are five field types in short message search conditions:

• Long text operators
• Fixed-length text operators
• Date operators
• Whole number operators
• Yes/No operators

Each field type works similarly to the standard Relativity field type of the same name, as defined below. The primary exception is long text, which uses advanced text search syntax that is similar to dtSearch. See Long text operators for more information.

See the Searchable fields section for a list of all fields available for short message searches.

Long text operators

Use text queries to search for long text. This enables searching Elasticsearch indexes with a syntax similar to dtSearch.

Elasticsearch index does not support all dtSearch syntax.

The table below shows search string examples and their expected results. You may also search using the “Is set” or “Is not set” operators to check for empty or filled values.

Search string	Returns RSMF documents with messages containing…
"apple pear"	The exact phrase apple pear.
apple AND pear	The words apple and pear.
apple OR pear	Either apple or pear.
apple W/5 pear	The word apple within five words of pear. The opposite is also true.
apple PRE/5 pear	The word apple within five words before pear. The opposite is not true.
apple AND NOT (pear)	The word apple but not the word pear.
pear*	Any word beginning with pear, including the word itself. For example, pears and Pearson.
pe?r	Any word beginning with pe with a single character between that and r. For example. pear or peer.

Reserved characters and words

Much like in dtSearch, there are characters and words that are reserved by the advanced text search syntax and must be treated differently to be searched.

• Reserved characters: " ( ) % * ? ~ ! / \ + - & | { } [ ] ^ : < >
• Reserved words: AND, OR, NOT, W/N, PRE/N (where "N" is a number)

To search for:

• Reserved characters—insert a backslash (\) before them. Examples:
  • To search for The cat is in the hat!, enter The cat is in the hat\!.
  • To search for the literal phrase, The query should be W/5, enter The query should be W\/5. That is W followed by backslash (\), then forward slash (/), and finally 5.

• Reserved words—use quotation marks around them, either individually or as part of a phrase. Example query: "Bob and Jill went to the market."
  • The word and is automatically searched because, logically, the AND operator cannot be used within a phrase.
  • To search for the word and separately, enter the query as: bob OR "and" AND jill

New syntax rules

As noted above, there are differences between how dtSearch and the advanced text search syntax behave with certain queries. The advanced text search syntax has several different requirements for certain queries to be valid. These are detailed below.

• Enclose all phrases within quotation marks. If not, a syntax error results.
• Any query containing multiple Boolean clauses must have each clause contained within parenthesis to ensure that the intended meaning of the query is clear.
  • Valid: (apple AND pear) OR (dog AND cat)
  • Invalid: apple AND pear OR dog AND cat
• Follow the NOT operator with parenthesis containing the content to be searched. This clearly identifies the content the NOT operator is acting on.
  • Valid: apple AND NOT (pear)
  • Invalid: apple AND NOT pear

Proximity operator (W/N, PRE/N) limitations

Compared with dtSearch, there are a few limitations described below on how you can use the two proximity operators.

• Do not use AND with proximity operators.
  • Invalid: (cat AND dog) W/7 bird
• Do not nest proximity operators.
  • Invalid: (cat W/3 dog) W/5 bird
• NOT cannot be used with W/N or PRE/N.
  • Invalid: cat NOT W/5 dog

Analyzer and wildcard behavior

Relativity’s short message search indexing uses Elasticsearch’s standard analyzer. This analyzer determines the rules by which words are broken into tokens, similar to dtSearch Alphabet and Noise Word files. It does not have any configuration options in RelativityOne.

The standard analyzer’s word breaking and punctuation behavior follows Unicode text segmentation rules. Typically, this results in the removal of punctuation marks. For instance, “bite-sized” would be processed as “bite sized,” with the word being treated as two separate tokens. There are edge cases where punctuation is indexed, especially with uncommon punctuation or foreign language text. However, the underlying rules are not consistent enough to be reliably summarized or predicted.

This may lead to overly inclusive results in the case of words with punctuation in them.

• For example, “bite\-sized” (escaping the hyphen character with a backslash) will match both “bite-sized” and “bite sized.” The hyphens are treated as whitespace in both the search term and the indexed text.

The behavior changes when using wildcards (* or ?), because search terms with wildcards are not analyzed. Search terms that include punctuation, like hyphens, are processed exactly as they appear. The punctuation is included in the search.

• For example, “bite\-siz*” (with the hyphen character escaped using a backslash) will not match any entries as the hyphen in the wildcard term would be searched for but would not be present in the index.
• There are multiple options for working around this behavior:
  • One is to search for the word both with and without punctuation, as this will cover normal cases plus any potential edge cases where the punctuation is present in the index. Example: bite\-siz* AND “bite siz*”
  • Another is to use the proximity operator. Example: bite W/2 siz*

The table below provides examples:

Search Term	Analyzed Term	Text in Document	Analyzed Text in Index	Match?
bite\-sized	bite sized	bite-sized	bite sized	Yes
bite sized	bite sized	bite-sized	bite sized	Yes
bite\-size*	bite\-size*	bite-sized	bite sized	No
bite W/2 size*	bite W/2 size*	bite-sized	bite sized	Yes

Fixed-length text operators

Fixed-length text values are entered using a simplified syntax relative to that of long text operators. Both single character wildcards (?) and multiple character wildcards (*) are supported, as well as escaping those characters using the backslash (\).

• Single character example:pa?s would match on both pads and pass when using the “Matches” operator.
• Multiple character example:d*ing would match on daring, dashing, and dancing.
• Escaping example:Did the query work\? would match that sentence including the question mark.

Fixed-length fields support the “Matches,” “Does not match,” “Is set,” and “Is not set” operators.

Date operators

The following operators are available for date field types. Values should be entered in UTC rather than your local time zone.

Operator	Returns Documents Where...
Is	The entered date is equal to the field value.
Is not	The entered date is not equal to the field value.
Is set	The field is not empty.
Is not set	The field is empty.
Is before	The field value is before the entered date.
Is before or on	The field value is before or on the entered date.
Is after	The field value is after the entered date.
Is after or on	The field value is on or after the entered date.
Between	The field value is between the two entered dates.

Whole number operators

The following operators are available for whole number field types.

Operator	Returns Documents Where...
Is	The entered number is equal to the field value.
Is not	The entered number is not equal to the field value.
Is set	The field is not empty.
Is not set	The field is empty.
Is less than	The field value is less than the entered number.
Is greater than	The field value is greater than the entered number.

Yes/No operators

The following operators are available for Yes/No field types.

Operator	Returns Documents Where...
Is	The selected value (Yes or No) is equal to the field value.
Is not	The selected value (Yes or No) is not equal to the field value. This operator covers situations where the field is either the opposite of the chosen value or not set. For example, Is not with a value of Yes would cover values of No or unset values.
Is set	The field is not empty.
Is not set	The field is empty.

Searchable fields

All searchable fields for short message searching.

Field name	Type	Explanation	Example
Attachment Count	Integer	Number of attachments on a message.	2
Attachment	Fixed-Length Text	Attachment filenames, including file extensions.	Sample.txt
Attachment IDs	Fixed-Length Text	Internal IDs referring to the attachments – generally matches the filename.	Sample.txt
Attachment Max Size	Integer	Max size of any attachments on a message.	381734829
Conversation Display	Long Text	Overview field that displays either the message platform or the channel and users.	Platform: Microsoft Teams Channel Name: new-project
Conversation Platform	Fixed-Length Text	Platform where the conversation took place.	Slack
Conversation ID	Fixed-Length Text	Internal ID referring to the conversation.	2386477
Conversation Type	Fixed-Length Text	Type of conversation, generally direct or channel.	direct
Deleted	Yes/No	Whether or not the message was deleted.	Yes
Document ID	Fixed-Length Text	Internal ID of a document.	1387384
Edited	Yes/No	If the message was edited at any time – returns Yes for any version of the edited message, including the original.	Yes
Event ID	Fixed-Length Text	Unique internal identifier for the event in the RSMF manifest.	C1
Event Important	Fixed-Length Text	Message importance, generally normal or high.	Normal
Event Parent	Fixed-Length Text	Unique internal identifier of the parent of the RSMF event, such as the thread that a message belongs to.	B1
Event Type	Fixed-Length Text	Type of event, generally message, join, disclaimer, or leave.	message
Message Body	Long Text	The body of the individual message.	This is an example of message body text.
Notes	Long Text	Message-level coding notes made in the Notes field of the Coding Layout.	This is an example of note text.
Privileged	Yes/No	Whether or not a message was coded as Privileged in the message-level coding layout.	Yes
Reaction Participants Display	Long Text	Names of conversation participants who left reactions on the message.	John Smith
Reaction Total Count Across Types	Integer	Total reactions left across a message.	5
Reaction Types	Fixed-Length Text	Reaction types of reactions left on a messages.	slightly_smiling_face
Reaction Types Count	Integer	Number of reaction types left on a message.	3
Responsive	Yes/No	Whether or not a message was coded as Responsive in the message-level coding layout.	Yes
Sender Account ID	Fixed-Length Text	Primary ID distinguishing the sender in the application, such as a phone number or social media handle.	1-555-921-4560
Sender Display	Long Text	Display name of the sender.	John Smith
Sender Email	Fixed-Length Text	Email address of the sender, if applicable to that platform.	john.smith@gmail.com
Sender ID	Fixed-Length Text	Unique internal identifier for the sender in the RSMF manifest.	P1
Timestamp	Date	Date and time that the message was sent.	5/1/2025 1:00 AM