# Has anyone tried to set the type of all fields to to wildcard field? **URL:** \ **Category:** Elasticsearch\ **Created:** [May 23, 2022, 1:55am UTC](https://discuss.elastic.co/t/has-anyone-tried-to-set-the-type-of-all-fields-to-to-wildcard-field/305364 "2022-05-23T01:55:59Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![stardust](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@stardust](https://discuss.elastic.co/u/stardust)\ **Post date:** [May 23, 2022, 1:55am UTC](https://discuss.elastic.co/t/has-anyone-tried-to-set-the-type-of-all-fields-to-to-wildcard-field/305364/1 "2022-05-23T01:55:59Z")
I want to set the type of all fields to to [wildcard field](https://www.elastic.co/cn/blog/find-strings-within-strings-faster-with-the-new-elasticsearch-wildcard-field) when searching log, no matter how big the value is or how many unique values there are.Is this possible? I have a little performance tests, it will bring a 30% increase in storage and write costs.It looks fine for me.But I'm not sure if the cost goes up more in some special logs. And there is a known problem using wildcard field with Kibana. KQL doesn't support wildcard field. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 23, 2022, 2:20am UTC](https://discuss.elastic.co/t/has-anyone-tried-to-set-the-type-of-all-fields-to-to-wildcard-field/305364/2 "2022-05-23T02:20:42Z")
Hi @stardust Welcome to the community. > [@stardust](#): > > I want to set the type of all fields to to [wildcard field](https://www.elastic.co/cn/blog/find-strings-within-strings-faster-with-the-new-elasticsearch-wildcard-field) when searching log, no matter how big the value is or how many unique values there are.Is this possible? Making all your fields `wildcard` type typically would not be considered a best practice. Typically you would keep original event and perhaps make that a `wildcard` field to search but not every field. This is not to say you cannot do make all your fields `wildcard` type, just that would be a bit unusual. There are performance and capability advantages to correctly typing your data. > [@stardust](#): > > I have a little performance tests, it will bring a 30% increase in storage and write costs.It looks fine for me.But I'm not sure if the cost goes up more in some special logs. Wildcard fields can Take quite a bit of storage and are not always the most performant from a Search perspective. It really Depends on the kind of searches you're going to do.. Do you really need a a `wildcard` type or would perhaps `match_only_text` might be better see [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/text.html#match-only-text-field-type). The difference is do you really need to do a search like `*string*` or If you use a a text type which is tokenizes the input then you just search on your `string` . > [@stardust](#): > > And there is a known problem using wildcard field with Kibana. KQL doesn't support wildcard field. That is not actually correct, but a common misunderstanding . KQL supports wildcards see [here](https://www.elastic.co/guide/en/kibana/current/kuery-query.html#_wildcard_queries). You just can't use the double quotes with it `"` KQL correct `my_field : string*` KQL incorrect the `*` is interpreted as a literal `my_field : "string*"` Perhaps if you provided some samples of the log lines and the types of searches you want to perform we could provide some guidance... again you can absolutely set every field to `wildcard` it just may have consequences depending on the type of the data and when you data grows. ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [May 23, 2022, 6:54am UTC](https://discuss.elastic.co/t/has-anyone-tried-to-set-the-type-of-all-fields-to-to-wildcard-field/305364/3 "2022-05-23T06:54:59Z")
One thing to remember with wildcard or regex searches that match anywhere in the string: **Keyword** field search costs are linear with the number of unique terms **Wildcard** field search costs are linear with the number of candidate matches. So if your field has a small number of values (eg month-of-the-year would have 12) then each of those values will have many associated docs. Each one of those docs’ values will need to be decompressed to check if it matches the regex. TL/DR: don’t use wildcard field for fields with small numbers of possible values ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 20, 2022, 6:55am UTC](https://discuss.elastic.co/t/has-anyone-tried-to-set-the-type-of-all-fields-to-to-wildcard-field/305364/4 "2022-06-20T06:55:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.