Doc_values and wildcard searches

(krisss) #1


Are wildcard searches supported on not_analyzed strings with doc_values enabled?
I wasn't able to find any info on this in docs. It works just fine for an exact match.

(Adrien Grand) #2

Doc values are not relevant here since they are not used for searching, only sorting and aggregations. Wildcard searches are supported on not_analyzed fields however.

(krisss) #3

Thanks for claryfication on doc values. You are saying they are supported on not_analyzed strings. However...

      "requestClientApplication" : {
        "type" : "string",
        "index" : "not_analyzed",
        "doc_values" : true


exact match

 curl -XGET 'http://localhost:9200/proxylog/proxylog/_count' -d '
     "query" : {
         "term" : { "requestClientApplication":"Mozilla"}


curl -XGET 'http://localhost:9200/proxylog/proxylog/_count' -d '
    "query" : {
        "term" : { "requestClientApplication":"Mozill*"}

Elasticsearch 1.5.1

(Adrien Grand) #4

Your second query searches for a term that is exactly "Mozill*" and does not exist in your index. You would need to use a wildcard query instead:

(krisss) #5

Thanks. You are right. The problem is with kibana.
It turned out I am affected by lowercase_expanded_terms. Looking for a way to bypass this.

(system) #6