# Is it possible to search on the field name through wildcard?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-search-on-the-field-name-through-wildcard/268452>\
**Category:** Elasticsearch\
**Created:** [March 26, 2021, 8:36am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-on-the-field-name-through-wildcard/268452 "2021-03-26T08:36:13Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Miguel\_BA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miguel_ba/32/46926_2.png) [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\
**Post date:** [March 26, 2021, 8:36am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-on-the-field-name-through-wildcard/268452/1 "2021-03-26T08:36:13Z")

</div>

Hello, I need to make a query that returns all the document names that have a value greater than 3.  
The problem is that the names of the documents are changing and are all different, so I do not know the full name of the documents, only their first initials.

```auto
    {
    "name":"mike",
    "surname" : "perez",
    "CVE-1232131123":"5" 
    }

```

The document is CVE-1232131123, always matches the initial CVE, but the following digits are random.  
Is there a way to filter out documents with a number greater than 3 without specifying the entire field?  
Thank you

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 26, 2021, 9:01am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-on-the-field-name-through-wildcard/268452/2 "2021-03-26T09:01:41Z")

</div>

It is IMHO general bad practice to have field names containing a value like that as it could lead to mapping explosion. It would be better to create a separate field for the CVE designation. As far as I know you can not do wildcard on field names.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 26, 2021, 9:10am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-on-the-field-name-through-wildcard/268452/3 "2021-03-26T09:10:28Z")

</div>

Agreed. I'd do something like:

```auto
{
    "name":"mike",
    "surname" : "perez",
    "cve-name": "CVE-1232131123",
    "cve-level": 5 
}

```

And BTW I'd make the `cve-level` a number and not a string.

---

<div class="post-metadata">

**Author:** ![Miguel\_BA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miguel_ba/32/46926_2.png) [@Miguel\_BA](https://discuss.elastic.co/u/Miguel_BA)\
**Post date:** [March 26, 2021, 9:46am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-on-the-field-name-through-wildcard/268452/4 "2021-03-26T09:46:00Z")

</div>

you are right that it is a bad practice, and I have indicated to modify the JSON in the way as you have said, with unique fields. But the above documents are created and I am looking into how to fix it with Elasticsearch.  
I have looked at the query\_string with range function:

> [@Query string with range](https://discuss.elastic.co/t/query-string-with-range/85111):
>
> I'm having difficulties getting the this one right. What did I miss? { "query": { "query\_string" : { "analyze\_wildcard": true, "query" : "failed to add key to cache" }, "range": { "@timestamp": { "gte": "now-900s" } } } }

Do you think this function can help me?  
Thanks for your answers

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 26, 2021, 10:06am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-on-the-field-name-through-wildcard/268452/5 "2021-03-26T10:06:47Z")

</div>

I'd reindex the existing documents.  
Either by reinjecting them from the source with the new schema or by using the reindex API with an ingest pipeline which can transform your documents.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2021, 10:07am UTC](https://discuss.elastic.co/t/is-it-possible-to-search-on-the-field-name-through-wildcard/268452/6 "2021-04-23T10:07:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.