Search / filter with wildcard


#1

Hi there,

I have a field payload with following value:

Routing to activemq:queue:tuxedoHighPriority.vpntbm2.2?exchangePattern=InOnly&messageConverter=#ttp2ActiveMQMessageConverter

I want to set a filter for "Routing to activemq:queue:tuxedoHighPriority.vpntbm*"
How do I do this? I tried the keyword and normal field of payload, tried with .* and only *, but I always get no match.

What is the correct syntax?

Thanks, Andreas


(Bill McConaghy) #2

This should work for you:

(fieldname:Routing and fieldname:activemq:queue:tuxedoHighPriority.vpntbm*)


#3

thanks for the reply, but it does not work. Lets concentrate on the second part of the query, where the wildcard comes into account.

payload: "activemq:queue*" -> does not work
payload: "activemq:queue:tuxedoHighPriority*" -> does not work
payload: "activemq:queue:tuxedoHighPriority.vpntbm*" -> does not work
payload: "activemq:queue:tuxedoHighPriority.vpntbm2*" -> does not work
payload: "activemq:queue:tuxedoHighPriority.vpntbm2.5" -> works
payload: "activemq:queue:tuxedoHighPriority.vpntbm2.5*" -> works

For me it looks like that it is not possible to search a substring inside an analyzed word. I am not sure, but I thought I used once in previous versions.
Using ES and Kibana 6.4.1.


#4

mapping of the field has been auto created and looks like the following:

"payload": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }

#5

in documentation https://www.elastic.co/guide/en/elasticsearch/reference/6.4/query-dsl-query-string-query.html#query-string-syntax (section wildcards) I understood that lucene supports wildcards in form of * and ?.

But this here does also not work for me:
payload: "activemq:queue:tuxedoHighPriority.vpntbm2.?"


(Bill McConaghy) #6

I got this to work with an analyzed field"

fieldname:/Routing to activemq:queue:tuxedoHighPriority.vpntbm2.*/


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.