# Filtering based on wildcard field name and synamicly adding them to \_source **URL:** \ **Category:** Elasticsearch\ **Created:** [May 1, 2018, 6:55am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092 "2018-05-01T06:55:53Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Post date:** [May 1, 2018, 6:55am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/1 "2018-05-01T06:55:53Z")
Hi everyone! I have a doc the looks like this: ``` { "field1_isChanged": "false", "field1_value": "someVal1", "field2_isChanged": "true", "field2_value": "someVal2", "field3_isChanged": "true", "field3_value": "someVal3", ... } ``` 1. What I would like to do is to search for the values of the fields that changed, in other words: find the values of FIELD where FIELD\_isChanged = true. I tried: But this return empty. Is there a way do do this? 1. when the search works, I don't want to see the entire doc, I want only the fields that matched the query. Usually, I would sort the fields I want to see in "\_source", but here I don't know beforehand the names of the fields that will match, only that there FIELD\_isChange is "true". Is there a way to dynamicly add field to \_source? And how about using wildcard in the field name in \_source? Thanks to anyone who can help! ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 1, 2018, 7:09am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/2 "2018-05-01T07:09:54Z")
I have a question. Why not indexing fields individually instead of a document containing multiple fields? ---
**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Post date:** [May 1, 2018, 7:23am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/3 "2018-05-01T07:23:40Z")
Like how? like this? ``` { "mappings": { "_doc": { "properties": { "FIELD": { "fields":{ "isChanged":"true" } } } } } } ``` Can something like this can be done? If you can elaborate on what you meant I could answer you more easly... ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 1, 2018, 8:28am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/4 "2018-05-01T08:28:31Z")
Like this: ```auto PUT fields/_doc/1 { "field_isChanged": "false", "field_value": "someVal1" } ``` ```auto PUT fields/_doc/2 { "field_isChanged": "true", "field_value": "someVal2" } ``` ---
**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Post date:** [May 1, 2018, 8:35am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/5 "2018-05-01T08:35:36Z")
I prefer not to do that because I have about 500+ fields, so sepertaing each field and sending http request for each one will be problematic. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 1, 2018, 8:50am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/6 "2018-05-01T08:50:28Z")
May be. I don't know the use case but according to what you described, you are searching for specific fields. You said that you don't want to see other fields if I understood correctly. So if you have: ```auto { "field1_isChanged": "false", "field1_value": "someVal1", "field2_isChanged": "true", "field2_value": "someVal2", "field3_isChanged": "true", "field3_value": "someVal3" } ``` > when the search works, I don't want to see the entire doc, I want only the fields that matched the query. So basically you'd like to see something: ```auto { "field_isChanged": "true", "field_value": "someVal3" } { "field_isChanged": "true", "field_value": "someVal2" } ``` If I'm wrong, it'd be better to share a real example. ---
**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Post date:** [May 1, 2018, 9:03am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/7 "2018-05-01T09:03:19Z")
You are right, this is what I want to achieve. Basicly: SELECT FIELD1\_VALUE WHERE FIELD2 = SOMEVALUE or in this example: get all fieldValue where field\_isChanged = true. Is there an easy way to do that? I want to point out that, if possible, I would like to search for a field with wildcard, if I don't know the filed name in advance, for example: get all FIELDValue where FIELDNAME\_isChanged = true, and FIELD can be specific field or all fields that their respective FIELD\_isChanged that matches the query. Can this wildcard style search can be done or will I need to search for specific field everytime? But the idea of using field and adding attributes to the mapping is intriguing. Can I just add to a value a sub field of isChanged and solve the whole thing by searching for: fieldVal where field.ischanged = true (in the same way one adds raw:keyword to a field)? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 1, 2018, 11:52am UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/8 "2018-05-01T11:52:07Z")
I think you will need to do that on client side or may be with nested type field and inner hits... ---
**Author:** ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Post date:** [May 1, 2018, 12:26pm UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/9 "2018-05-01T12:26:06Z")
so there is no way to get the results I want? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 1, 2018, 3:08pm UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/10 "2018-05-01T15:08:56Z")
As I said, may be with nested type and inner hits. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 29, 2018, 3:09pm UTC](https://discuss.elastic.co/t/filtering-based-on-wildcard-field-name-and-synamicly-adding-them-to-source/130092/11 "2018-05-29T15:09:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.