# Best Optimization for wildcard queries

**URL:** <https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738>\
**Category:** Elasticsearch\
**Created:** [January 9, 2023, 12:41pm UTC](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738 "2023-01-09T12:41:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sheharyar\_Khalid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sheharyar_khalid/32/112227_2.png) [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\
**Post date:** [January 9, 2023, 12:41pm UTC](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738/1 "2023-01-09T12:41:30Z")

</div>

Hello,  
I am working with elasticsearch on audit log data. I wanted to know what are the best optimizations and **tokenizer/analyzer/term usages** for optimizing elastic for wildcard queries. I have looked at **n-grams** and they looked interesting but I could find no proper guide/documentation for optimizing elastic to my use case.

**My use case**  
We are trying to search for program path string in log data. For example we have data that has strings like **C://user/home/folder1/folder2/folder3/malware** and we wish to run a wildcard \*malware and we hope to match the document with the above string.

What would be the best path (if any) to go about such use case. What tokenizer should we use? I was looking at wildcard term features. Is this any different from keyword term?

Any help/guidance will be appreciated.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 9, 2023, 12:43pm UTC](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738/2 "2023-01-09T12:43:19Z")

</div>

Have you looked at the [wildcard field type](https://www.elastic.co/guide/en/elasticsearch/reference/8.5/keyword.html#wildcard-field-type)?

---

<div class="post-metadata">

**Author:** ![Sheharyar\_Khalid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sheharyar_khalid/32/112227_2.png) [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\
**Post date:** [January 9, 2023, 1:06pm UTC](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738/3 "2023-01-09T13:06:34Z")

</div>

@Christian_Dahlqvist  
I will look into it. Should I pair it with n-gram tokenizer or any other tokenizer that is optimal for wildcard queries?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 9, 2023, 1:10pm UTC](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738/4 "2023-01-09T13:10:38Z")

</div>

I believe it uses ngrams behind the scenes, so you do not need to pair it with anything as far as I know.

---

<div class="post-metadata">

**Author:** ![Sheharyar\_Khalid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sheharyar_khalid/32/112227_2.png) [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\
**Post date:** [January 9, 2023, 2:30pm UTC](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738/5 "2023-01-09T14:30:09Z")

</div>

Thank you for the help. Appreciate it!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2023, 2:30pm UTC](https://discuss.elastic.co/t/best-optimization-for-wildcard-queries/322738/6 "2023-02-06T14:30:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.