It depends on how things are indexed basically.
It'd be bette to provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.
A full reproduction script will help readers to understand, reproduce in Kibana Console and if needed fix your problem.
Anyway, I'd definitely not use wildcard specifically with something like *foo*. As written in documentation:
Note that this query can be slow, as it needs to iterate over many terms. In order to prevent extremely slow wildcard queries, a wildcard term should not start with one of the wildcards * or ?.