How to search value with Wild card

Elastic Stack Kibana
1

Hi Experts,

In my log I have a field "Customer". It has all the values in capital latter like "VIKAS". Now when I fire query in Kibana like Customer:"vikas" or Customer:"VIK*" I got nothing . It works only when I do exact search like Customer:"VIKAS".

I have following question

  1. How I can search value with wildcard, something like name start with vi OR VI ?

My Template is like

{
"template_vg":{
"template" : "vg*",
"settings" : {
"number_of_shards" : 5,
"index.cache.field.type" : "soft",
"index.refresh_interval" : "5s",
"index.store.compress.stored" : true,
"index.query.default_field" : "message",
"index.routing.allocation.total_shards_per_node" : 5,
"index":{
"analysis":{
"analyzer":{
"analyzer_keyword":{
"type": "custom",
"tokenizer":"keyword",
"filter":"lowercase"
}
}
}
}
},
"mappings" : {
"default" : {
"_all" : {"enabled" : false},
"properties" : {
"Order_ID": {"type": "string","index" :"not_analyzed","doc_values" : true},
"Customer": {"type": "string","index" : "not_analyzed","doc_values" : true ,"analyzer":"analyzer_keyword"},
"Ordered_On": {"type": "string","index" : "not_analyzed","doc_values" : true },
"Required_By": {"type": "string","index" : "not_analyzed","doc_values" : true },
"Freight": {"type": "string","index" : "not_analyzed","doc_values" : true },
"Shipped_On": {"type": "string","index" : "not_analyzed","doc_values" : true },
"Country": {"type": "string","index" : "not_analyzed","doc_values" : true },
"Post_Code": {"type": "string","index" : "not_analyzed","doc_values" : true }

			}
		}
	}
}

}

I read almost everything and got an idea that I need to use analyzer with Lowercase filter which will convert my values to lowercase then I can apply wildcard.But with the above analyzer for Customer field I still got nothing . Can someone help me to understand what I am doing wrong .

2

That's correct. Not analysed means you need to query the exact same as what is in the value.

3

Wow That works...:slight_smile: Thank you Warkolm