# Filtering with wildcard

**URL:** <https://discuss.elastic.co/t/filtering-with-wildcard/360085>\
**Category:** Kibana\
**Created:** [May 23, 2024, 2:39pm UTC](https://discuss.elastic.co/t/filtering-with-wildcard/360085 "2024-05-23T14:39:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cebula](https://avatars.discourse-cdn.com/v4/letter/c/f9ae1b/32.png) [@Cebula](https://discuss.elastic.co/u/Cebula)\
**Post date:** [May 23, 2024, 2:39pm UTC](https://discuss.elastic.co/t/filtering-with-wildcard/360085/1 "2024-05-23T14:39:30Z")

</div>

Need some help with the use of wildcard in filter.

Filter log.level : ERROR and message: "This topic with id\*" will – as expected – list all data which starts with ’This topic with id’  
If I include the not keyword in log.level : ERROR and not message: "This topic with id\*", I was expected to exclude all data with "This topic with id\*", but the outcome include all data.

Any ideas?

---

<div class="post-metadata">

**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\
**Post date:** [May 24, 2024, 2:14pm UTC](https://discuss.elastic.co/t/filtering-with-wildcard/360085/2 "2024-05-24T14:14:23Z")

</div>

I wonder if the quotation marks around the `message` query are not getting applied as a wildcard filter?

Can you open the "Inspect" flyout and then copy the DSL query from the "Request" tab?

---

<div class="post-metadata">

**Author:** ![Cebula](https://avatars.discourse-cdn.com/v4/letter/c/f9ae1b/32.png) [@Cebula](https://discuss.elastic.co/u/Cebula)\
**Post date:** [May 27, 2024, 10:16am UTC](https://discuss.elastic.co/t/filtering-with-wildcard/360085/3 "2024-05-27T10:16:17Z")

</div>

"query": {  
"bool": {  
"must": ,  
"filter": [  
{  
"bool": {  
"filter": [  
{  
"multi\_match": {  
"type": "phrase",  
"query": "test-log",  
"lenient": true  
}  
},  
{  
"bool": {  
"should": [  
{  
"match": {  
"log.level": "ERROR"  
}  
}  
],  
"minimum\_should\_match": 1  
}  
},  
{  
"bool": {  
"must\_not": {  
"multi\_match": {  
"type": "phrase",  
"query": "EntityType exists, look at \*",  
"lenient": true  
}  
}  
}  
}  
]  
}  
},  
{  
"range": {  
"@timestamp": {  
"format": "strict\_date\_optional\_time",  
"gte": "2024-01-01T04:10:00.000Z",  
"lte": "2024-01-18T04:20:00.000Z"  
}  
}  
}  
],  
"should": ,  
"must\_not":   
}  
}