# Kibana 7.10 searching with special characters and wildcard

**URL:** <https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [September 6, 2021, 3:41am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397 "2021-09-06T03:41:03Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![cps598](https://avatars.discourse-cdn.com/v4/letter/c/858c86/32.png) [@cps598](https://discuss.elastic.co/u/cps598)\
**Post date:** [September 6, 2021, 3:41am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397/1 "2021-09-06T03:41:03Z")

</div>

I want to use \* with some special characters.  
e.g. url.path: "/apis/aa.bb.io/v1/checking"\* and user: "system"\*

keep getting the error messages:  
KQLSyntaxError: Expected AND, OR, end of input, whitespace but "_" found.  
url.path: "/apis/aa.bb.io/v1/checking"_ and user: "system"\*  
-----------------------------------------------------^

Can anyone help me?  
Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 6, 2021, 4:50am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397/2 "2021-09-06T04:50:33Z")

</div>

Welcome to our community! 😃

At a guess it's because you have a wildcard outside the quotes. What are you trying to find?

---

<div class="post-metadata">

**Author:** ![cps598](https://avatars.discourse-cdn.com/v4/letter/c/858c86/32.png) [@cps598](https://discuss.elastic.co/u/cps598)\
**Post date:** [September 6, 2021, 5:58am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397/3 "2021-09-06T05:58:45Z")

</div>

> [@warkolm](#):
>
> the quotes. What are you trying

I want to find something like url.path start with "/apis/aa.bb.io/v1/checking" --\> /apis/aa.bb.io/v1/checkingxxxxxxxxxx  
but I don't know how to search it.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 6, 2021, 6:01am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397/4 "2021-09-06T06:01:09Z")

</div>

Take a look at [Kibana Query Language | Kibana Guide [7.14] | Elastic](https://www.elastic.co/guide/en/kibana/current/kuery-query.html#_wildcard_queries)

---

<div class="post-metadata">

**Author:** ![cps598](https://avatars.discourse-cdn.com/v4/letter/c/858c86/32.png) [@cps598](https://discuss.elastic.co/u/cps598)\
**Post date:** [September 6, 2021, 6:38am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397/5 "2021-09-06T06:38:48Z")

</div>

I read it before, there is no answer using special characters and wildcards.

please help me.  
Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 6, 2021, 6:47am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397/6 "2021-09-06T06:47:19Z")

</div>

That link literally points to a section called `Wildcards queries`, if that's not working then it'd be good to understand why not.

---

<div class="post-metadata">

**Author:** ![cps598](https://avatars.discourse-cdn.com/v4/letter/c/858c86/32.png) [@cps598](https://discuss.elastic.co/u/cps598)\
**Post date:** [September 7, 2021, 8:40am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397/7 "2021-09-07T08:40:48Z")

</div>

Anyone can help me?

e.g want to find user.id values start with "system:"

My search: user.id:system:\*

Error code:  
KQLSyntaxError: Expected "(", "{", value, whitespace but end of input found.  
user.id:  
----------^

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2021, 8:41am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397/8 "2021-10-05T08:41:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.