DISCO search syntax manual

DISCO uses Westlaw and Lexis-style search syntax with boolean search operators. These can be used in a fieldless search or with a field such as tag(Responsive or "Further Review"). This guide explains how to search in DISCO. For a training video about DISCO's search and review features, see DISCO 101: Search & Review.

Search basics
- Order of operations
- Searching documents in families
Document fields
Numeric searches
Metadata redactions
Custom fields

Search basics

Operators	Description	Example
`&, and`	Includes results with both terms	`contract & payment` `contract and payment` — Documents that contain both contract and payment
`[space]``,` `or`	Includes results with either term or field	`contract payment` `contract or payment` — Documents that contain contract or payment
`%, not`	Excludes term or field from results	`contract % payment` `contract not payment` — Documents that contain contract but do not contain payment
`+family`	Includes family members as search hits for the entire query or any portion of a query; learn more here	`to("Jane.Smith@email.com")+family & "risk factors"` — Returns emails, and family members of those emails, sent to Jane.Smith@email.com that include the phrase “risk factors” `tag(Responsive)+family % tag(Attorney-Client)+family` — Returns documents tagged Responsive and documents whose family members are tagged Responsive, but removes documents tagged Attorney-Client and family members of documents tagged Attorney-Client.
`/n`	Proximity search, searching within n words, in any order	`contract /10 payment` — Documents that contain contract within ten words of payment, where the order is irrelevant
`+n`	Proximity search, searching within n words in prescribed order	`contract +10 payment` — Documents that contain contract within ten words of payment, where contract must precede payment
`“ ”`	Exact phrase intended	`“contract payment”` — Documents that contain the exact phrase contract payment `“Matt.Motley@email.com”` — Documents that contain the email address Matt.Motley@email.com Be sure to include quotes when searching for an email address.
`!`	Truncation search or root expander; can be used at the beginning of a term, end of a term, or both	`contract!` — Documents that contain any term starting with contract, for example, contract, contracts, contractual, contracting, or contracted `!contract` — Documents that contain any term ending with contract, for example, subcontract `filename(!contract!)` — Documents with the term contract anywhere in the file name
*``**	Wildcard search for single character	*`contract`** — Searches for words that have one, but only one, character after contract, such as contracts, but not contracted, contractual, or contract
`~`	Fuzzy or approximate word search. Fuzzy searching allows for the addition, deletion, or substitution of up to two letters in a word.	`guaranty~` — Searches for guaranty, guarantee, garanty, and similar (mis)spellings
`.`	Period in a name or email address	`Matt.Motley` — Documents that contain Matt.Motley (with the period), but not MattMotley (without the period)
`( )`	Grouping syntax	`(failure & consideration) & (contract agreement)` — Documents must contain both failure and consideration, and must also contain either contract or agreement
`sample(n, search)`	Returns n documents randomly selected from results of search. If n is less than 1, this number is treated as a percentage.	`sample(.5, contract)`; `sample(700, contract)` — Returns 50% and 700 of the search results for contract at random, respectively
`field(terms)`	Field searching (see below for standard DISCO fields)	`custodian(Holcombe)` — Documents with Holcombe in the custodian field

DISCO ignores most punctuation and non-alphanumeric characters when searching. Periods, colons, semicolons, and apostrophes within a word are not removed. As an example, periods in a name or email address are indexed and searchable. Word operators (and, or, and not) can be searched if placed in quotation marks, “contract and payment”.

Order of operations

DISCO performs a search using the following order of operations:

Exact phrases: “ ”
Groupings: ( )
Proximity: /n, +n
Family subsearch: +family
&, and, %, not
[space], or

Searching documents in families

DISCO has two powerful features to help you navigate and search families of documents: family inclusion mode and family subsearch.

Family mode allows reviewers to view documents in the context of their entire family by including family members in the search results list.
Family subsearch is a search syntax capability allowing you to include family members as search hits. +family can be added to any valid query, or any portion of a query that would be a valid standalone query.

Document fields

Fieldless, or keyword, searches the document text, document notes, subject lines, custodians, authors, and user defined fields.

User-created information

Field	Description	Example
`documentNote`	A notes field for each document	`documentNote(hot)` — Documents with the word hot in the document note field `documentNote(!)` — Documents with any document note
`field`	Custom metadata field added by admin-level users that is used to capture additional information	`field(important)` — Documents with important in any user defined field `contract(draft)` — Documents with draft in the Contract user defined field
`folder`	Folder created in DISCO by a user	`folder("Hot Documents")` — Documents in the Hot Documents DISCO folder `folder("Hot Documents/Experts")` — Documents in the Experts subfolder `folder("Hot Documents/!")` — Documents in the Hot Documents folder and all subfolders
`privilegeNote`	A privilege notes field for each document	`privilegeNote("Legal Advice")` — Documents using the phrase Legal Advice inside the privilege note `privilegeNote(!)` — Documents with any privilege note
`production`	A name assigned by the user to each set of documents produced using DISCO	`production("defense")` — Documents produced in the defense production set
`redactionReason`	Optional user-created text that can describe redactions	`redactionReason("Trade Secret")` — Documents with Trade Secret applied as a redaction reason
`referenceid`	Optional identification number users can assign (contact DISCO Support to do so)	`referenceid(245)` — Document with Reference ID number 245
`searchTermReport`	Documents matching the search criteria within a search term report	`searchTermReport("Responsive Terms")` — Documents matching the search scope and search terms within the Responsive Terms search term report
`stage`	A set of documents created by users for linear review	`stage("First Pass Review")` — Documents in the First Pass Review stage
`stageBatched`	Documents in stages that have been pulled into batches	`stageBatched("First Pass Review")` — Documents in the First Pass Review stage that have been placed in batches (whether or not yet reviewed)
`stageComplete`	Documents in stages that have been marked "reviewed" and checked-in	`stageComplete("Privilege Review")` — Documents in the Privilege Review stage that have been marked reviewed and contained in a checked-in batch (i.e. complete)
`stageReviewed`	Documents in stages that have been marked "reviewed"	`stageReviewed("Privilege Review")` — Documents in the Privilege Review stage that have been marked reviewed
`tag`	Fields appended to documents by users	`tag(responsive)` — Documents with the responsive tag
`tagGroup`	Fields from a specific group appended to documents by users	`taggroup(Issue)` — Documents with a tag from the Issue group

Document metadata & attributes

Metadata is data about a document that is not part of the document’s content. Metadata can include things like the creation date, author, sending and receiving information, file name, and file path.

Field	Description	Example
`author`	Identifies the author or creator of a file	`author(Jones)` — Documents that Jones authored
`batesNumber`	Bates numbers applied to documents, either from a DISCO production or elsewhere	`batesNumber(Enron000009)` — A document receiving the Bates stamp Enron000009 `batesNumber(Enron000007 to Enron000950)` — Documents with Bates numbers within the identified range
`batesPrefix`	The English portion of the Bates stamp	`batesPrefix(Enron)` — Documents that use Enron as a Bates prefix `batesPrefix(!)` — Documents with any Bates prefix
`bcc`	A recipient that was blind carbon copied on an email	`bcc("Sarah.Smith@email.com")` — Emails in which Sara Smith is blind copied
`billingSize`	Returns all documents with the indicated size in bytes relative to the review database's billing statement	`billingSize(>1000000)` — Documents with a billing size greater than 1,000,000 bytes
`cc`	A recipient that was carbon copied on an email	`cc("Bill.Jones@email.com")` — Emails in which Bill Jones is copied `cc(Smith)` — Emails where a CC recipient has Smith in the first or last name
`childCount`	Returns all parent documents that have the specified number of children. A child is typically an attachment to an email or an embedded file in a document. A parent is the document containing the attachment or file.	`childCount(2)` — Emails or other documents that have two children `childCount(1 to 1000)` — Emails or other documents that have between 1 and 1000 children
`comment`	Returns all documents with the indicated text left inline in the original file	`comment(!)` — All documents with comments in the original files
`company`	Returns all documents created by the same company	`company(Enron)` — Documents created by Enron
`conversationCount`	Returns all emails belonging to conversations that contain the number or range of emails specified. Conversations include the various responses, replies, and forwards of an email chain.	`conversationCount(3)` — Emails that contain three emails within the conversations `conversationCount(3 to 15)` — Emails that contain between three and 15 emails within the conversations
`custodian`	Typically the individual or location from which a document was collected	`custodian(Peterson or Jones)` — Documents that have Peterson or Jones in the custodian name field `custodian("Andrew Lewis")` — Documents in which exactly Andrew Lewis is the custodian
`dataSpace`	Searches for documents in a specific data space - see this feature spotlight for more information	`dataSpace(ECA)` — Documents in the ECA data space `dataSpace("Active Review")` — Documents in the Active Review data space
`dedupHash`	The unique identifier used to deduplicate documents at the time of ingest	`DeDupHash(ABC123!)` — Document with a deduplication hash starting with ABC123
`domain`	An email domain (typically, the text after the @ symbol)	`domain(winlaw.com)` — Emails sent to or from email addresses (also including cc and bcc fields) having winlaw.com as the domain (e.g., johnsmith@winlaw.com)
`extension`	Returns all documents with the specified file extension	`extension(.doc)` — Documents with the .doc file extension
`familyConsistentTag`	Returns documents where every family member has the specified tag. Limited to documents in families.	`familyConsistentTag(Responsive)`— Documents where every family member has a Responsive tag
`familyInconsistentTag`	Returns documents that do not have the specified tag, where at least one of its family members has the specified tag. Limited to documents in families.	`familyInconsistentTag(Responsive)`— Documents without a Responsive tag, where at least one of its family members has a Responsive tag
`fileLength`	Returns files corresponding to the specified size of the file (in bytes)	`fileLength(25000)` — Documents that are exactly 25,000 bytes `fileLength(>1000000)` — Documents with file sizes greater than 1,000,000 bytes
`filename`	The filename of any document Emails often have filenames, though largely hidden in most applications	`filename(Agenda.pdf)` — Documents with the exact filename agenda.pdf `filename(Agenda!)` — Documents that begin with Agenda in the filename (e.g., Agenda.pdf; AgendaForMay11.doc; or Agenda for Meeting.ppt) `filename(!Agenda!)` — Documents with Agenda anywhere in the filename
`folderpath`	Any folder in which a document was saved (such as a computer or network drive)	`folderpath("Deleted items")` — Documents that were in the Deleted items folder when collected This search locates any discrete folder within the tree of folders and subfolders (e.g., MyComputer/Files/DeleteItems
`from`	Identifies the sender of an email	`from(Lee)` — Emails sent by Lee
`hasDetectedSlipsheet`	DISCO identifies when a slipsheet is produced in conjunction with a native file for load file ingests, and will create a near-native image from the native file	`hasDetectedSlipsheet(yes)` — Documents that have a slipsheet
`hasDocumentNote`	Returns documents that include a document note	`hasDocumentNote(yes)` — Documents that have a document note
`hashes`	Searches across deduphash, sha1hash, md5hash, and objecthash	`hashes(xyonqy!)` — Document with a hash starting with xyonqy
`hasHiddenType`	Returns documents with hidden content detected. Hidden content can include comments, hidden sheets, notes, hidden rows, etc.	`has``HiddenType(yes)` — Documents that have hidden content detected
`hasImage`	Indicates if an item was processed as an image or not. An image is sometimes also referred to as a “near native” or “PDF.”	`has``Image(yes)` — Documents that were processed as images
`hasLanguage`	Documents that have an identified language	`hasLanguage(yes)` — Documents that have a language identified
`hasNative`	Indicates if the native file was not supplied. If an image is supplied, DISCO will use that to populate the native file link. If no native or image is supplied, DISCO will create a near-native image from the supplied text and use that to populate the native link.	`hasNative(yes)` — Documents with a native file supplied
`hasOCR`	Returns documents for which any of the extracted text was derived via OCR	`hasOCR(yes)` — Documents with text extracted via OCR
`hasPrivilege`	Returns documents that include a privilege tag	`hasPrivilege(yes)` — Documents with a privilege tag
`hasPrivilegeNote`	Returns documents that include a privilege note	`hasPrivilegeNote(yes)`— Documents that have a note
`hasRedaction`	Searches for documents that have redactions, do not have redactions, or have redactions in a specific location.	`hasRedaction(yes)`— Documents with a redaction `hasRedaction(onDocument) % hasRedaction(onMetadata)` — Documents with a redaction on the document but not on metadata
`hasRedactionReason`	Searches for documents that have redaction reasons, do not have redaction reasons	`hasRedactionReason(yes)` — Documents that have a redaction reason
`hasRedactionWithout Reason`	Searches for documents that have a redaction, but no corresponding redaction reason.	`hasRedactionWithoutReason(yes)` — Documents with a redaction that does not have a corresponding redaction reason `hasRedactionWithoutReason(onMetadata)` — Documents with metadata redactions that do not have a corresponding redaction reason
`hasSearchText`	Returns documents that include searchable text	`hasSearchText(yes)` — Documents with searchable text
`hasWrongExtension`	Indicates if the extension of an ingested item is inconsistent with the determined type	`hasWrongExtension(yes)` — Documents ingested as a file type that differs from the indicated type
`hiddentText`	Hidden text is text that has been set to be hidden in the original file	`hiddentText(yes)` — Documents that have hidden text in their original files
`hiddentype`	Identifies whether hidden data is in a file, including comments, revisions, notes, hidden sheets, or very hidden sheets	`hiddentype(revisions)` — Documents with hidden revisions
`id`	An identification number assigned by DISCO that is unique to each document in the database	`id(1200)` — The document with DISCO identification number 1200 `id(>500)` — Documents with DISCO identification numbers greater than 500
`imageSize`	Returns documents with the indicated size in bytes of the document’s image file	`imageSize(>1000000)` — Documents whose image size is greater than 1,000,000 bytes
`ingestSessionId`	A number assigned to each group of documents ingested into DISCO	`ingestSessionId("IngestSessions/1")` — Documents ingested into DISCO in Ingest Session 1
`ingestType`	Indicates which of the two types of data deliveries can be processed	`ingestType(native)` — Documents processed as native files Native — Files delivered as they were maintained during the normal course of business Load file - Files (either images only or images with natives) accompanied by a load file that supplies family relationship and metadata information
`invisibleText`	Invisible text is text that is the same color as its background	`invisibleText(yes)` — Documents that contain invisible text
`isDetectedEmail`	Files identified as emails during processing based on an examination of the file's text/OCR	`isDetectedEmail(yes)` — Documents identified as emails
`isInclusive`	Returns emails with unique content	`isInclusive(yes)` — Filters out emails that are duplicated within inclusive emails
`isProcessedAsNative`	Indicates that some aspect of processing was unsuccessful. However, DISCO will create a record in the matter with a link to the native file.	`isProcessedAsNative(yes)` — Documents that were processed unsuccessfully
`md5Hash`	MD5 hash of the file binary; 32 characters	`md5hash(vgbc2c!)` — Document with an MD5 hash starting with vgbc2c
`objectHash`	Hash of the file document, without considering the parent document; 40 characters For non-email files, objecthash is the same as sha1hash. For email files, objecthash is computed by extracting and hashing parts of an email including sent date, sender, message body, and a few more.	`objecthash(hpsrxo!)` — Document with an object hash starting with hpsrxo
`pageCount`	Returns documents containing the specified number of pages in an image	`pageCount(1)` — Documents that have one page `pageCount(101 to 3000)` — Documents whose image has between 101 and 3000 pages
`parentCount`	Returns documents with the specified number or range of parents	`parentCount(1)` — Children (such as attachments or embedded files) that have only one parent `parentCount(0)` — Only parents (i.e., excludes all attachments and embedded files), and "loose" files that have no children or parent files
`path`	Location from which the document was collected	`path("My Computer/Deleted Items/!")` — Documents that were saved, when collected, in the My Computer/Deleted Items folder, as well as all documents in subfolders
`prediction`	Tag predictions are useful for finding documents that DISCO predicts are likely or unlikely to receive a specific tag	`prediction("responsive", highly likely)` — Documents that are highly likely to be tagged responsive `prediction("Work-Product", >20)` — Documents that have a likelihood score over 20 to be tagged Work-Product
`primaryLanguage`	Returns documents that have the specified primary language	`primaryLanguage(French)` — Documents in which the greatest portion of the content is in French
`processingDetails`	Returns documents with the specified processing reason	`processingDetails(Password protected)` — Documents that were identified as password protected during processing
`processingStatus`	Returns documents with the specified processing outcome	`processingStatus(Successful)` — Documents that were successfully processed
`recipient`	Searches the combined email metadata fields: to, cc, and bcc (i.e., anyone who was the recipient of an email)	`recipient(Jones)` — Emails in which Jones appears in the metadata of the to, from, or bcc fields
`search`	Searches using the criteria of a saved search	`search("Privileged Emails")`— Returns documents responsive to the saved search Privileged Emails
`sha1hash`	SHA-1 hash of the file binary; 40 characters	`sha1hash(wyt9sz!)` — Document with a SHA-1 hash starting with wyt9sz
`similarCount`	Returns documents with the specified number of similar documents	`similarCount(5)` — Documents with exactly 5 similar documents `similarCount(>7)` — Documents with more than 7 similar documents
`speakerNote`	Speaker notes are slide-specific notes that are hidden from the audience, but are visible to the presenter while editing	`speakerNote(yes)` — Documents that include speaker notes
`subject`	Searches the subject (or "re:" line) of an email	`subject(meeting)` — Emails with meeting in the subject line
`subjectNormalized`	Searches for exact match against the subject without "Re:" or "Fwd:"	`subjectNormalized("Transaction documents")` — Searches for the exact subject Transaction documents while ignoring "Re:" or "Fwd:"
`text`	The extracted text in a document image - does not search metadata	`text(Peter)` — Documents containing Peter anywhere within the document image
`to`	Identifies to whom an email was sent	`to(Duncan)` — Emails in which Duncan (either as a first or last name) was in the to field `to("Duncan Kennedy")` — Emails sent to Duncan Kennedy
`tagcount`	Documents with a specific count of tags	`tagcount(2)` — Documents with exactly two tags `tagcount(>0)` — Documents that have any tag
`textLength`	Returns documents with the specified number or range of characters in the text of an image, including spaces	`textLength(3000000)` — Documents with 300,000 characters in the text
`title`	Returns documents with the specified document title	`title(``GAS PURCHASE AGREEMENT``)` — Documents whose metadata title is GAS PURCHASE AGREEMENT
`type`	The type of a document in DISCO is the file type such as email, Word, or PDF	`type(Word)` — All Word files `type(email)` — All emails
`unfoldered`	Documents that are, or are not, within a folder	`unfoldered(yes)` — Documents that are not in a folder

Date fields

Dates can be searched by exact date, a range of dates, and before or after a date. Dates can be formatted as date certain (12/10/2015), month and year (9/2016), or year (2012). For example:

Exact: date(5/4/09)
Range: date(5/4/09)
Before: date(before 5/10/09)
After: date(after 5/10/09

Field	Description
`conversationDate`	For all documents in an email conversation, the conversation date is the send date of the first email in the conversation.
`createDate`	Created date is the date the file was created.
`date`	Date searches the send date of emails and the last modified date of all other document types.
`familyDate`	For all documents in a family, the family date is the sent date (for emails) or last modified date (for non-emails) of the family head document.
`lastAccessedDate`	The last accessed date is the date the file was last accessed.
`lastModifiedDate`	The last modified date is the date changes were last made to a file.
`lastPrintedDate`	The last printed date is the date the file was last printed.
`loadDate`	The load date is the date documents were ingested into DISCO.
`receivedDate`	The received date is the date an email was received.
`sendDate`	The sent date is the date an email was sent.

Tag predictions

Tag prediction uses AI to predict a tag or tags that should be applied to a document. Tag prediction search syntax is displayed below. Search syntax can accommodate multiple tags, e.g., prediction("tag name1" & "tag name2", >20).

Field Description

prediction("tag name", Likeliness value)

prediction(Attorney-Client, Highly likely) — Documents that are highly likely to be tagged Attorney-Client

prediction(Attorney-Client, Likely) — Documents that are likely to be tagged Attorney-Client

prediction(Attorney-Client, Neutral) — Documents that are neither likely nor unlikely to be tagged Attorney-Client

prediction(Attorney-Client, Unlikely) — Documents that are unlikely to be tagged Attorney-Client

prediction(Attorney-Client, Highly unlikely) — Documents that are highly unlikely to be tagged Attorney-Client

prediction("tag name", score range)

prediction(Attorney-Client, -20 to 20)

— Documents that have a likelihood score in the range of -20 to 20 to be tagged Attorney-Client

prediction(Attorney-Client, >20)

— Documents that have a likelihood score over 20 to be tagged Attorney-Client

prediction("tag name", exact score)

prediction(Attorney-Client, 20)

— Documents that have a likelihood score of 20 to be tagged Attorney-Client

Tag decisions

Tagging decisions can also be searched by dates applied and users applying them, using the following syntaxes:

Field	Description
`tag(by "reviewer@lawfirm.com")`	Documents tagged by reviewer@lawfirm.com
`tag(responsive & by "reviewer@lawfirm.com")`	Documents tagged responsive by reviewer@lawfirm.com
`tag(non-responsive % by "reviewer@csdisco.com")`	Documents tagged non-responsive by someone other than reviewer@csdisco.com
`sample(10, tag(by "reviewer@csdisco.com"))`	Ten random documents tagged by reviewer@csdisco.com
`tag(by "reviewer@csdisco.com" & on 10/16/2015)`	Documents tagged by reviewer@csdisco.com on 10/16/2015
`tag(responsive & by "reviewer@csdisco.com" & before 10/16/2015)`	Documents tagged responsive by reviewer@csdisco.com before 10/16/2015
`removedTag(responsive)`	Documents from which the responsive tag was removed (by anyone)
`removedTag(by "reviewer@lawfirm.com")`	Documents from which any tags were removed by reviewer@lawfirm.com

Numeric searches

The following numeric fields can search for an exact document, a range of documents, or documents greater than or less than the indicated value. For example:

id(1234)
id(1 to 1234)
id(>1234)
id(<1234)

Numeric fields

id( )
billingSize( )
childCount( )
conversationCount( )
fileLength( )
imageSize( )
pageCount( )
parentCount( )
similarCount( )
tagcount( )
textLength( )

Metadata redactions

Redaction fields can search for redactions on specific metadata, including:

Any metadata: hasRedaction("onmetadata")
File name: hasRedaction("filename")
Path: hasRedaction("path")
Custodian: hasRedaction("custodian")
Subject: hasRedaction("subject")
From: hasRedaction("from")
To: hasRedaction("to")
Cc: hasRedaction("cc")
Bcc: hasRedaction("bcc")
Send date: hasRedaction("senddate")
Received date: hasRedaction("receiveddate")
Author: hasRedaction("author")
Created date: hasRedaction("createddate")
Modified date: hasRedaction("lastmodifieddate")
Printed date: hasRedaction("lastprinteddate")
Accessed date: hasRedaction("lastaccesseddate")
Company: hasRedaction("company")
Title: hasRedaction("title")

Custom fields

DISCO supports user defined fields created in the product, and custom fields ingested from a load file. The search syntax works similarly for both types of custom fields.

Example	Description
`Deposition(!)`	Documents with any contents in the Deposition field
`Deposition(Important)`	Documents with the word Important in the Deposition field
`"My notes"(!)`	Documents with any contents in the My notes field
`"My notes"("Review again")`	Documents with Review again in the My notes field

There are two additional searches for user defined fields.

Example	Description
`hasFields(true)`	Documents with contents in any user defined field
`field("Red Team")`	Documents with Red Team in any user defined field

Contents

Search basics

Order of operations

Searching documents in families

Document fields

User-created information

Document metadata & attributes

Date fields

Tag predictions

Tag decisions

Numeric searches

Metadata redactions

Custom fields

Articles in this section

Contents

Search basics

Order of operations

Searching documents in families

Document fields

User-created information

Document metadata & attributes

Date fields

Tag predictions

Tag decisions

Numeric searches

Metadata redactions

Custom fields

Related articles

Articles in this section