# Flattened fields and \`query\_string\` queries with leading wildcard

**URL:** <https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576>\
**Category:** Elasticsearch\
**Created:** [January 23, 2025, 11:52am UTC](https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576 "2025-01-23T11:52:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddittmar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddittmar/32/140892_2.png) [@ddittmar](https://discuss.elastic.co/u/ddittmar)\
**Post date:** [January 23, 2025, 11:52am UTC](https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576/1 "2025-01-23T11:52:26Z")

</div>

Hi, I'm seeing unexpected behaviors with flattened fields and `query_string` queries with leading wildcard. I'm new to Elasticsearch so maybe someone could help me out.

I'm using 8.15.2 but I see the same behavior on 8.17.1

Here's my `test_index`:

```auto
PUT http://localhost:9200/test_index
Authorization: Basic elastic elastic
Content-Type: application/json

{
  "mappings": {
    "properties": {
      "test_field": {
        "type": "flattened"
      }
    }
  },
  "settings": {
    "index": {
      "number_of_shards": "1",
      "number_of_replicas": "1"
    }
  }
}

```

My test data:

```auto
### dataset1
POST http://localhost:9200/test_index/_doc
Authorization: Basic elastic elastic
Content-Type: application/json

{
  "test_field": {
    "test1": "the first test test1 foo bar",
    "test2": "the second test test2 foo bar"
  }
}

### dataset2
POST http://localhost:9200/test_index/_doc
Authorization: Basic elastic elastic
Content-Type: application/json

{
  "test_field": {
    "test3": "the third test test3 foo bar",
    "test4": "the fourth test test4 foo bar"
  }
}

```

This query

```auto
GET http://localhost:9200/test_index/_search
Authorization: Basic elastic elastic
Content-Type: application/json

{
  "query": {
    "query_string": {
      "fields": [
        "test_field.test4"
      ],
      "query": "*first*"
    }
  }
}

```

gives me:

```auto
...
    "hits": [
      {
        "_index": "test_index",
        "_id": "...",
        "_score": 1.0,
        "_source": {
          "test_field": {
            "test1": "the first test test1 foo bar",
            "test2": "the second test test2 foo bar"
          }
        }
      }
    ]
...

```

It looks like the query did not only looked at `test_field.test4`. I've expected no results.  
If I changed my query to:

```auto
GET http://localhost:9200/test_index/_search
Authorization: Basic elastic elastic
Content-Type: application/json

{
  "query": {
    "query_string": {
      "fields": [
        "test_field.test4"
      ],
      "query": "first*"
    }
  }
}

```

I get no results. That is the behavior I would expect.

I've found this [Flattened fields with query\_string and wildcards](https://discuss.elastic.co/t/flattened-fields-with-query-string-and-wildcards/303400) whitch looks like the same problem but sadly there is no answer.  
I couldn't find anything describing this in the documentation.

I hope someone could give me a hint

Cheers,

Dirk Dittmar

---

<div class="post-metadata">

**Author:** ![dor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dor/32/102216_2.png) [@dor](https://discuss.elastic.co/u/dor)\
**Post date:** [January 23, 2025, 1:09pm UTC](https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576/2 "2025-01-23T13:09:31Z")

</div>

Hi, I opened the old thread you were referring to.  
Sadly, after I contacted the support, they told me its unsupported, like the regular wildcard query on flattened fields.

As far as I know, this bug still persists

---

<div class="post-metadata">

**Author:** ![ddittmar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddittmar/32/140892_2.png) [@ddittmar](https://discuss.elastic.co/u/ddittmar)\
**Post date:** [January 23, 2025, 1:31pm UTC](https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576/3 "2025-01-23T13:31:06Z")

</div>

Thanks for the reply... did you find any other solution?  
I've switched to `flattened` fields because I ran into the "Limit of total fields [1000] has been exceeded while adding new fields" Problem and found this thread: [Approaches to deal with “Limit of total fields [1000] in index has been exceeded”](https://discuss.elastic.co/t/approaches-to-deal-with-limit-of-total-fields-1000-in-index-has-been-exceeded/241039)

---

<div class="post-metadata">

**Author:** ![ddittmar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddittmar/32/140892_2.png) [@ddittmar](https://discuss.elastic.co/u/ddittmar)\
**Post date:** [January 30, 2025, 7:14am UTC](https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576/4 "2025-01-30T07:14:03Z")

</div>

I found a solution that works for me. Maybe this will help someone.

Instead of `flattened` fields I use `nested` fields with the following structure (from the mapping):

```auto
"aFieldName": {
  "type": "nested",
  "properties": {
    "key": {
      "type": "keyword"
    },
    "value": {
      "type": "wildcard"
    }
  }
},

```

... the data looks like this:

```auto
"aFieldName": [
    {
      "key": "street",
      "value": "a street name here"
    },
    {
      "key": "phone",
      "value": "7607"
    },
...

```

... and I can query (`filter` in this case) and sort like this ("select where street contains 'gold' sort by phone"):

```auto
{
    "query": {
        "bool": {
            "filter": [
                {
                    "nested": {
                        "path": "aFieldName",
                        "query": {
                            "bool": {
                                "must": [
                                    {
                                        "term": {
                                            "aFieldName.key": {
                                                "value": "street"
                                            }
                                        }
                                    },
                                    {
                                        "wildcard": {
                                            "aFieldName.value": {
                                                "case_insensitive": true,
                                                "value": "*gold*"
                                            }
                                        }
                                    }
                                ]
                            }
                        }
                    }
                }
            ]
        }
    },
    "sort": [
        {
            "aFieldName.value": {
                "nested": {
                    "filter": {
                        "term": {
                            "aFieldName.key": {
                                "value": "phone"
                            }
                        }
                    },
                    "path": "aFieldName"
                },
                "order": "desc"
            }
        }
    ]
}

```

... so far it seams to work fine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2025, 7:14am UTC](https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576/5 "2025-02-27T07:14:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.