No results found / wildcard via Query Bar

[alexus]

I'm using Query bar (at the top of Kibana) to search like this:

bin: 123456*

I get a lot of hits, however when I add filter; bin -> is -> 123456*, I get 0 hits (No results found), bin field contains 6 OR 7 numbers and I'd like to include 6 AND 7 numbers results into my filter.

Please advise.

[LeeDr (Lee Drengenberg)]

I'm confused if you're putting bin -> is -> 123456* in the query bar just like that?

If bin is a number data type, you could just do bin:>123456 and it would get results that are greater than that.

[alexus]

I apologize for confusion, let me try to put it in a different way:

search #1:

• I put bin: 123456* into Query Bar - got plenty of results

search #2:

• I tried to create a filter to accomplish same as method #1 by Add a filter (UNDER Query Bar), then in Filter drop down select bin followed by is as operator and for value I entered 123456* and got no results.

---

bin field is a keyword type field that contains following bins: 123456, 1234560, 1234561, 1234562 ... 1234569 (in different documents of course) and I'd like to capture all of them without specifying each (using operator is one of).

[LeeDr (Lee Drengenberg)]

When you select a keyword to filter on, Kibana tries to give you a list of keywords to select from and then creates a query to match phrase. Apparently you can still edit it and add a wildcard.

{
  "query": {
    "match": {
      "extension.raw": {
        "query": "jpg",
        "type": "phrase"
      }
    }
  }
}

But according to this page, (go to the very bottom of the page in the box) you can't use wildcards in a phrase match query.
https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-match-query.html
Actually, you can use wildcards but they're either ignored completely or they are trying to match the literal string 123456* with an asterisk in it.

Compare that with the query you get if you put the query in the query bar;

"query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "extension:jp*",
            "analyze_wildcard": true,
            "default_field": "*"
          }
        },
    },

So you could edit the filter and change from the phase query to a regular query so that wildcards are used.

[alexus]

I couldn't get wildcard to work through Query bar and if I understand correctly, it's simply not possible to do (to me, wildcard is "a must", apparently not).

however, maybe Query String Query | Elasticsearch Reference | Elastic is an answer?