Kibana partial/substring matches are not working

[Rakesh_B]

Hi,

Setup: Elasticsearch version 7.6.1
field name is log, here is the config in index template:

        "log": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },

1. Partial match doesn't work in KQL and Lucene:
   

   
   

2. Another question:
   It works if I put a wildcard like this in both KQL and Lucene log: *RedisConnectionFailureException but when put double quotes it doesn't work even with a wildcard

   

We are trying to do a partial/substring search in Kibana UI but we are not getting any results, it seems to works only with wildcard expressions. Can you please tell us how to enable it OR let us know if we are doing anything wrong?

[wylie (Wylie Conlon)]

I can help you with the syntax and general understanding of what is happening with these queries.

1. It looks like you're expecting partial matches on substrings without whitespace. This is not the default behavior of Elasticsearch, and you need to implement a different text analysis configuration to get this without wildcards.

2. Wildcards work the way you'd expect, which is that if you have a single token like **Production**RedisConnectionFailureException, then a wildcard can match the missing prefix like *RedisConnectionFailureException.

You have already figured out the correct syntax for wildcards. The syntax you used in the last example, without double quotes, is correct for KQL.

I notice that you are multi-mapping this field, so you have both log and log.keyword fields, but you aren't searching log.keyword. You may want to read up on mapping options.