# Can't query asterisk

**URL:** <https://discuss.elastic.co/t/cant-query-asterisk/40627>\
**Category:** Kibana\
**Created:** [February 1, 2016, 11:28am UTC](https://discuss.elastic.co/t/cant-query-asterisk/40627 "2016-02-01T11:28:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lwintergerst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lwintergerst/32/18164_2.png) [@lwintergerst](https://discuss.elastic.co/u/lwintergerst)\
**Post date:** [February 1, 2016, 11:28am UTC](https://discuss.elastic.co/t/cant-query-asterisk/40627/1 "2016-02-01T11:28:51Z")

</div>

Hi,  
EDIT: The post displayed was not the same I wrote ☹ My backslashes were not displayed...

I am unable to search for the asterisk '\*' character.  
I got the following events indexed(3 with \*, 1 without):

```
"http_request": "/this/is/a/request/?firstName=John&lastName=Doe&something=false"
"http_request": "/this/is/a/request/?firstName=John&lastName=*&something=false"
"http_request": "/this/is/a/request/?firstName=*&lastName=Doe&something=false"
"http_request": "/this/is/a/request/?firstName=*&lastName=*&something=false"

```

They have the following mapping(I also tried with "analyzed", but it does not work either):

```
"http_request ": {
"type": "string",
"index": "not_analyzed"
},

```

I tried the following. Everything gives me no results at all.  
http\_request:\*  
http\_request:"\_"  
http\_request:"_\*\*"  
http\_request:/_/  
http\_request:/\_/

and possibly some others that I can't think of right now. But nothing seems to work...

I can reindex the data with a different mapping if you want.

Luca

---

<div class="post-metadata">

**Author:** ![stormpython](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stormpython/32/7190_2.png) [@stormpython](https://discuss.elastic.co/u/stormpython)\
**Post date:** [February 1, 2016, 7:36pm UTC](https://discuss.elastic.co/t/cant-query-asterisk/40627/2 "2016-02-01T19:36:06Z")

</div>

lwintergerst,

I am not sure why the `*` wildcard search is not working for you.

Could it be that the `"http_request "` field has empty spaces at the end in the mapping? If you are entering these:

```auto
"http_request": "/this/is/a/request/?firstName=John&lastName=Doe&something=false"
"http_request": "/this/is/a/request/?firstName=John&lastName=*&something=false"
"http_request": "/this/is/a/request/?firstName=*&lastName=Doe&something=false"
"http_request": "/this/is/a/request/?firstName=*&lastName=*&something=false"

```

in the kibana search bar, try removing the `"` (quotes) from `http_request` and from the search string, eg.

```auto
http_request: /this/is/a/request/?firstName=John&lastName=*&something=false

```

Let me know if any of those work.

---

<div class="post-metadata">

**Author:** ![lwintergerst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lwintergerst/32/18164_2.png) [@lwintergerst](https://discuss.elastic.co/u/lwintergerst)\
**Post date:** [February 1, 2016, 7:50pm UTC](https://discuss.elastic.co/t/cant-query-asterisk/40627/3 "2016-02-01T19:50:07Z")

</div>

I just noticed that I had to escape my back slashes in my post above. Would you mind taking a look again? Thanks!

The spaces in the mapping are probably a copy/paste error, as there was no other mapping for the field in the mapping.  
I can check tomorrow just to be sure

---

<div class="post-metadata">

**Author:** ![jaminvp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaminvp/32/5868_2.png) [@jaminvp](https://discuss.elastic.co/u/jaminvp)\
**Post date:** [February 5, 2016, 2:01pm UTC](https://discuss.elastic.co/t/cant-query-asterisk/40627/4 "2016-02-05T14:01:21Z")

</div>

In case you haven't found a solution yet, in Kibana 4.1.2 I had an issue with the query where my search string was turned into lowercase before Kibana queries Elasticsearch.

I fixed it by changing the query:queryString options (Settings -\> Advanced) to:  
{ "analyze\_wildcard": true, "lowercase\_expanded\_terms": false }

Your problem might be unrelated though!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:03pm UTC](https://discuss.elastic.co/t/cant-query-asterisk/40627/5 "2017-07-06T14:03:25Z")

</div>