How to match text fields which ends with using KQL?

We are trying to match from the following text field which is indexed.

We found that

1. DNSQuery : *amazonaws*


2. DNSQuery : goto*

matched goto

3. DNSQuery :


4. DNSQuery : *desktop*

matches desktop.s3

5. DNSQuery :


Please note that - and second . are not matched, but the first and third . matched.

How can we match any queries starting ending with only.

When we tried to match the following


6. DNSQuery : *

we don't get any match.

How can we match all the queries which ends with ?

Hey! Where exactly are you trying to filter documents with KQL in kibana? If you are using the search bar which is on the top of Discover, Dashboard and Lens applications

There are 2 ways to do it:

  1. use the KQL bar and do something like:
text.keyword : *
  1. Create a DSL filter like that
  "query": {
    "query_string": {
      "fields": [
      "query": "*"

When we searched on the keyword instead of the text field, it is working

Thank you :smile:

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.