Why domain : *.02222105.com include www.02222105.com and 02222105.com
but not include www100.02222105.com
How to Search all Domain (Lucene or KQL)
Thanks you Master
Have you tried this in KQL?
domain: *.02222105.com
(Without the quotes?)
Try this in Lucene query:
domain.keyword:*.02222105.com
You can use "Inspect" button to get the actual search request and it is really useful in debug.
The context you want to compare is original string not analyzed terms, so you should use the keyword field.
Once you use " double quote, Kibana will use Phrase Query in KQL or just escape the double quote in Lucene query, that is not what you want.