# Query string with wild card not returning the expected results , all the times

**URL:** <https://discuss.elastic.co/t/query-string-with-wild-card-not-returning-the-expected-results-all-the-times/207883>\
**Category:** Elasticsearch\
**Created:** [November 14, 2019, 12:17pm UTC](https://discuss.elastic.co/t/query-string-with-wild-card-not-returning-the-expected-results-all-the-times/207883 "2019-11-14T12:17:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sngs1](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@sngs1](https://discuss.elastic.co/u/sngs1)\
**Post date:** [November 14, 2019, 12:17pm UTC](https://discuss.elastic.co/t/query-string-with-wild-card-not-returning-the-expected-results-all-the-times/207883/1 "2019-11-14T12:17:30Z")

</div>

I am using ES 6.4 .  
When I tried  
GET /\_search?size=10&from=0  
{  
"\_source":["name"],  
"query":{  
"query\_string" : {  
"query" : "(some1.some.string.test.query.1234.test) AND (status:active) AND NOT (xyz OR abc)",  
"fields" : ["name"]  
}  
}  
}

It is returning expected results.

But when I tried ,  
GET /\_search?size=10&from=0  
{  
"\_source":["name"],  
"query":{  
"query\_string" : {  
"query" : "(_some1.some.string.test.query.1234._) AND (status:active) AND NOT (xyz OR abc)",  
"fields" : ["name"]  
}  
}  
}

It is returning null, even though matches are there.  
{  
"took": 38,  
"timed\_out": false,  
"\_shards": {  
"total": 5,  
"successful": 5,  
"skipped": 0,  
"failed": 0  
},  
"hits": {  
"total": 0,  
"max\_score": null,  
"hits":   
}  
}

Can any of you give me more idea on what happens in this case, when wild card is used along with longer strings?  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![MiTschMR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mitschmr/32/48254_2.png) [@MiTschMR](https://discuss.elastic.co/u/MiTschMR)\
**Post date:** [November 14, 2019, 12:29pm UTC](https://discuss.elastic.co/t/query-string-with-wild-card-not-returning-the-expected-results-all-the-times/207883/2 "2019-11-14T12:29:20Z")

</div>

Hi @sngs1

I think you need to escape the "\*" character as follows:

```auto
some1.some.string.test.query.1234.\*

```

I had to do this too with ELK version 6.6.1. Since version 7.x (I dont remember exactly which one) it is no longer necessary to escape.

Hope this helps.

---

<div class="post-metadata">

**Author:** ![sngs1](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@sngs1](https://discuss.elastic.co/u/sngs1)\
**Post date:** [November 14, 2019, 12:34pm UTC](https://discuss.elastic.co/t/query-string-with-wild-card-not-returning-the-expected-results-all-the-times/207883/3 "2019-11-14T12:34:33Z")

</div>

Thanks for the reply. I have already tried using backslash.  
But single backslash is not supported

`\*some1.some.string.test.query.1234.\*`  
"type": "json\_parse\_exception",  
"reason": "Unrecognized character escape '\*' (code 42)\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@55a18add; line: 5, column: 21]"

So I tried  
`\\*some1.some.string.test.query.1234.\\*` with double backslash, and that gave me the expected results.

But the same on a small string (sub string of the same) didn't returned any results.  
`\\*some1.\\*`  
{  
"took": 1,  
"timed\_out": false,  
"\_shards": {  
"total": 5,  
"successful": 5,  
"skipped": 0,  
"failed": 0  
},  
"hits": {  
"total": 0,  
"max\_score": null,  
"hits":   
}  
}

---

<div class="post-metadata">

**Author:** ![MiTschMR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mitschmr/32/48254_2.png) [@MiTschMR](https://discuss.elastic.co/u/MiTschMR)\
**Post date:** [November 14, 2019, 12:42pm UTC](https://discuss.elastic.co/t/query-string-with-wild-card-not-returning-the-expected-results-all-the-times/207883/4 "2019-11-14T12:42:22Z")

</div>

Hi @sngs1

Have you tried using the same string in the Kibana search mask?

---

<div class="post-metadata">

**Author:** ![sngs1](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@sngs1](https://discuss.elastic.co/u/sngs1)\
**Post date:** [November 19, 2019, 6:14am UTC](https://discuss.elastic.co/t/query-string-with-wild-card-not-returning-the-expected-results-all-the-times/207883/5 "2019-11-19T06:14:38Z")

</div>

No, I will try.  
It is also not returning the expected results if we search for some string like  
"@xyz.com"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2019, 6:14am UTC](https://discuss.elastic.co/t/query-string-with-wild-card-not-returning-the-expected-results-all-the-times/207883/6 "2019-12-17T06:14:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.