# Query Assistance Needed

**URL:** <https://discuss.elastic.co/t/query-assistance-needed/356198>\
**Category:** Elasticsearch\
**Created:** [March 26, 2024, 5:44pm UTC](https://discuss.elastic.co/t/query-assistance-needed/356198 "2024-03-26T17:44:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Post date:** [March 26, 2024, 5:44pm UTC](https://discuss.elastic.co/t/query-assistance-needed/356198/1 "2024-03-26T17:44:42Z")

</div>

Hi,  
I have a need to search our log indices to:

- find documents containing fields with names prefixed with a specific string
- return those fields
- return the field "application.name", which is a standard field

How might I go about doing this?

Thx  
D

---

<div class="post-metadata">

**Author:** ![demjened](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/demjened/32/109159_2.png) [@demjened](https://discuss.elastic.co/u/demjened)\
**Post date:** [March 26, 2024, 7:44pm UTC](https://discuss.elastic.co/t/query-assistance-needed/356198/2 "2024-03-26T19:44:49Z")

</div>

Hi dawiro,

You want to search for prefixed fields that have some content, right? Normally the [exists](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-exists-query.html) query would do the trick, but that cannot be used in conjunction with wildcards. However the [query\_string](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html) query supports wildcards:

```auto
PUT my-index/_doc/1
{
  "application.name": "my-app",
  "fooz": "hello world"
}

PUT my-index/_doc/2
{
  "application.name": "my-app",
  "barz": "what's up"
}

PUT my-index/_doc/3
{
  "application.name": "my-app",
  "food": "hello again"
}

POST my-index/_search
{
  "query": {
    "query_string": {
      "query": "*",
      "default_field": "foo*" // Returns docs 1 and 3
    }
  },
  "fields": [
    "application.name", "foo*"
  ]
}

```

Hopefully this helps!

---

<div class="post-metadata">

**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Post date:** [March 27, 2024, 7:47am UTC](https://discuss.elastic.co/t/query-assistance-needed/356198/3 "2024-03-27T07:47:40Z")

</div>

This is useful thank you. How can I exclude an `application.name` of a particular value?

---

<div class="post-metadata">

**Author:** ![demjened](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/demjened/32/109159_2.png) [@demjened](https://discuss.elastic.co/u/demjened)\
**Post date:** [March 27, 2024, 1:32pm UTC](https://discuss.elastic.co/t/query-assistance-needed/356198/4 "2024-03-27T13:32:49Z")

</div>

You need to write a compound [bool query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html) with a `must` clause on the query string above, and a `must_not` clause on `application.name`, i.e.

```auto
POST _search
{
  "query": {
    "bool": {
      "must": {
        "query_string": { 
          "query": "*",
            "default_field": "foo*"
          }
        }
      },
      "must_not": {
        "term": {
          "application.name" : "value_you_dont_want"
        }
      }
    }
  }
}

```

Make sure you're matching on the correct field type of `application.name` - if it's `text`, use a `match` query, if it's `keyword`, use `term`. (More info [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html).)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2024, 1:32pm UTC](https://discuss.elastic.co/t/query-assistance-needed/356198/5 "2024-04-24T13:32:53Z")

</div>

Closed on April 24, 2024, 1:32pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.