# Search for field values with wildcard

**URL:** <https://discuss.elastic.co/t/search-for-field-values-with-wildcard/133047>\
**Category:** Elasticsearch\
**Created:** [May 23, 2018, 8:24pm UTC](https://discuss.elastic.co/t/search-for-field-values-with-wildcard/133047 "2018-05-23T20:24:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zozo6015](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zozo6015/32/12117_2.png) [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Post date:** [May 23, 2018, 8:24pm UTC](https://discuss.elastic.co/t/search-for-field-values-with-wildcard/133047/1 "2018-05-23T20:24:21Z")

</div>

Hello,

I have imported java logs into elasticsearch and some of the fields have ended up having huge multiline values. I am in need to search for a pattern in the value. Is there a way. Can I do that?

Regards,  
Peter

---

<div class="post-metadata">

**Author:** ![polyfractal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polyfractal/32/48162_2.png) [@polyfractal](https://discuss.elastic.co/u/polyfractal)\
**Post date:** [May 23, 2018, 8:40pm UTC](https://discuss.elastic.co/t/search-for-field-values-with-wildcard/133047/2 "2018-05-23T20:40:37Z")

</div>

Yep, there's a simple [Wildcard Query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html), and a more advanced [Regexp Query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html).

There's also a [Grok Ingest Processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/grok-processor.html) which can be configured with regexp patterns, and will extract the blobs of text into structured documents while ingesting. That's the preferred method (or using something like Logstash) because it makes search a lot simpler than trying to use regex queries.

---

<div class="post-metadata">

**Author:** ![zozo6015](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zozo6015/32/12117_2.png) [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Post date:** [May 23, 2018, 8:48pm UTC](https://discuss.elastic.co/t/search-for-field-values-with-wildcard/133047/3 "2018-05-23T20:48:06Z")

</div>

I am using logstash to inject the log into elasticsearch. I have a very specific situation when I have to set an alert for some kind of pattern of the data of the logs. I have tried from kibana but I don't seam to be able to get the proper data out of it.

To be more exact here is a log example: [https://paste.vpsie.com/paste.php?id=7388](https://paste.vpsie.com/paste.php?id=7388)

and the pattern I want to search for is system.jetty.data: "java.lang.IllegalStateException, zip file closed"

Regards,  
Peter

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2018, 8:48pm UTC](https://discuss.elastic.co/t/search-for-field-values-with-wildcard/133047/4 "2018-06-20T20:48:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.