Doc_values and wildcard searches

Elastic Stack Elasticsearch
1

Hi,

Are wildcard searches supported on not_analyzed strings with doc_values enabled?
I wasn't able to find any info on this in docs. It works just fine for an exact match.

2

Doc values are not relevant here since they are not used for searching, only sorting and aggregations. Wildcard searches are supported on not_analyzed fields however.

3

Thanks for claryfication on doc values. You are saying they are supported on not_analyzed strings. However...

      "requestClientApplication" : {
        "type" : "string",
        "index" : "not_analyzed",
        "doc_values" : true

}

exact match

 curl -XGET 'http://localhost:9200/proxylog/proxylog/_count' -d '
 {
     "query" : {
         "term" : { "requestClientApplication":"Mozilla"}
     }
 }'
{"count":**1615**,"_shards":{"total":5,"successful":5,"failed":0}}

wildcard

curl -XGET 'http://localhost:9200/proxylog/proxylog/_count' -d '
{
    "query" : {
        "term" : { "requestClientApplication":"Mozill*"}
    }
}'
{"count":**0**,"_shards":{"total":5,"successful":5,"failed":0}}

Elasticsearch 1.5.1

4

Your second query searches for a term that is exactly "Mozill*" and does not exist in your index. You would need to use a wildcard query instead: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html

5

Thanks. You are right. The problem is with kibana.
It turned out I am affected by lowercase_expanded_terms. Looking for a way to bypass this.