# DSL query with multiple wildcard and timestamp range - syntax check

**URL:** <https://discuss.elastic.co/t/dsl-query-with-multiple-wildcard-and-timestamp-range-syntax-check/173054>\
**Category:** Elasticsearch\
**Created:** [March 19, 2019, 9:03pm UTC](https://discuss.elastic.co/t/dsl-query-with-multiple-wildcard-and-timestamp-range-syntax-check/173054 "2019-03-19T21:03:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shankarps](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarps/32/78663_2.png) [@shankarps](https://discuss.elastic.co/u/shankarps)\
**Post date:** [March 19, 2019, 9:03pm UTC](https://discuss.elastic.co/t/dsl-query-with-multiple-wildcard-and-timestamp-range-syntax-check/173054/1 "2019-03-19T21:03:09Z")

</div>

I am trying to create a DSL query to search for a text with wild cards. I have the following working API call.  
`http://localhost:9200/_search?q="Error creating" AND @timestamp:["2019-03-18T17:01:49Z" TO "2019-03-18T18:00:48Z"]`

I have verified that this query returns expected results.

I am trying to extend the call to search for multiple wild card texts within a range as a request body search.

Can anyone please check the syntax and why it doesnt work as expected?

```
{
  "query": {
    "bool": {
      "must": [
        {
        "wildcard" : { "detailmsg" : { "value" : "*Error creating used syndication lead*" } }
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1552867260000,
              "lte": 1552863660000,
              "format": "epoch_millis"
            }
          }
        }
      ]
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![glenacota](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/glenacota/32/41367_2.png) [@glenacota](https://discuss.elastic.co/u/glenacota)\
**Post date:** [March 19, 2019, 9:07pm UTC](https://discuss.elastic.co/t/dsl-query-with-multiple-wildcard-and-timestamp-range-syntax-check/173054/2 "2019-03-19T21:07:40Z")

</div>

Hi,  
It'd be helpful to know what it means that it's not working as expected. For example, do you get no results? do you get some results, but they're wrong? do you get an error?

Also, is `detailmsg` a keyword type? Because `wildcard` queries work only for non-analysed fields.

---

<div class="post-metadata">

**Author:** ![shankarps](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarps/32/78663_2.png) [@shankarps](https://discuss.elastic.co/u/shankarps)\
**Post date:** [April 16, 2019, 9:06pm UTC](https://discuss.elastic.co/t/dsl-query-with-multiple-wildcard-and-timestamp-range-syntax-check/173054/3 "2019-04-16T21:06:27Z")

</div>

Hi, sorry for the delayed response. I wanted to see how to convert the API search into an equivalent DSL syntax, with multiple wild card entries at the same time (to avoid multiple search).

While I get results for the API call, with curl, I am not getting any results for the DSL query submitted via Rest client.

"detailmsg" is a field. Please let me know any error in the query. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2019, 9:06pm UTC](https://discuss.elastic.co/t/dsl-query-with-multiple-wildcard-and-timestamp-range-syntax-check/173054/4 "2019-05-14T21:06:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.