# How to search all Domain

**URL:** <https://discuss.elastic.co/t/how-to-search-all-domain/282797>\
**Category:** Kibana\
**Created:** [August 30, 2021, 10:05am UTC](https://discuss.elastic.co/t/how-to-search-all-domain/282797 "2021-08-30T10:05:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mick1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mick1/32/80138_2.png) [@Mick1](https://discuss.elastic.co/u/Mick1)\
**Post date:** [August 30, 2021, 10:05am UTC](https://discuss.elastic.co/t/how-to-search-all-domain/282797/1 "2021-08-30T10:05:56Z")

</div>

Why domain : \*.02222105.com include [www.02222105.com](http://www.02222105.com) and [02222105.com](http://02222105.com)  
but not include [www100.02222105.com](http://www100.02222105.com)

How to Search all Domain (Lucene or KQL)

Thanks you Master

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/2/824af32d89bdf303c784b8a87fb26c26e0d43ec0.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/3/1364bd27b3588dd4c7a283e77d12353f11a4783e.png)

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [August 31, 2021, 6:42pm UTC](https://discuss.elastic.co/t/how-to-search-all-domain/282797/2 "2021-08-31T18:42:42Z")

</div>

Have you tried this in KQL?

```auto
domain: *.02222105.com

```

(Without the quotes?)

---

<div class="post-metadata">

**Author:** ![Mick1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mick1/32/80138_2.png) [@Mick1](https://discuss.elastic.co/u/Mick1)\
**Post date:** [September 1, 2021, 1:37am UTC](https://discuss.elastic.co/t/how-to-search-all-domain/282797/3 "2021-09-01T01:37:11Z")

</div>

> [@lukas](#):
>
> quotes

Without the quotes Lucene

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0f37fab4b096d7df57cb80c3fbfe50676664b202.png)

Without the quotes KQL

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/9/59dfa3f727879effdfe1fac858b92cc39a991a17.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c4a113dc7477e8442c779151eebc3ab56b2c1530.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a0a10299aef45154162ee201b8ff629fd34e6db7.png)

This Question :  
First Word "www100" ( word + number combination) can't use \*.02222105.com

---

<div class="post-metadata">

**Author:** ![joecwu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joecwu/32/37258_2.png) [@joecwu](https://discuss.elastic.co/u/joecwu)\
**Post date:** [September 9, 2021, 4:07am UTC](https://discuss.elastic.co/t/how-to-search-all-domain/282797/4 "2021-09-09T04:07:20Z")

</div>

Try this in `Lucene` query:

```auto
domain.keyword:*.02222105.com

```

You can use "Inspect" button to get the actual search request and it is really useful in debug.  
The context you want to compare is `original string` not `analyzed terms`, so you should use the `keyword` field.

Once you use `"` double quote, Kibana will use Phrase Query in KQL or just escape the double quote in Lucene query, that is not what you want.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2021, 4:07am UTC](https://discuss.elastic.co/t/how-to-search-all-domain/282797/5 "2021-10-07T04:07:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.