# Search matching issue

**URL:** <https://discuss.elastic.co/t/search-matching-issue/22325>\
**Category:** Elasticsearch\
**Created:** [February 23, 2015, 11:14am UTC](https://discuss.elastic.co/t/search-matching-issue/22325 "2015-02-23T11:14:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![emkt84](https://avatars.discourse-cdn.com/v4/letter/e/7ba0ec/32.png) [@emkt84](https://discuss.elastic.co/u/emkt84)\
**Post date:** [February 23, 2015, 11:14am UTC](https://discuss.elastic.co/t/search-matching-issue/22325/1 "2015-02-23T11:14:22Z")

</div>

I have ELK setup and indexing logs from our servers. We see a strange  
behavior while we try to search from Kibana. For example

field: \*.value.v1

results in no results when field value is like: xyz.value.v1 But when we do  
query as

field: \*value.v1

we get the results. So the "." after \* creates the issues. But if the field  
value is xyz-zz.value.v1 then query

field: \*.value.v1

give the result. So We think it seems to be related to tokenizer and  
analyzer. We are using default settings from Elasticsearch and the field is  
mapped as string. So any help or suggestion in changing the analyzer  
settings in mapping or any idea in solving this issue will be helpful.

We are using Elasticsearch 1.3.6 and Kibana 3.1

Regards,  
Em

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/ad331688-a7d7-466c-8369-727d1f09e3e2%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/ad331688-a7d7-466c-8369-727d1f09e3e2%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:30am UTC](https://discuss.elastic.co/t/search-matching-issue/22325/2 "2017-07-06T00:30:50Z")

</div>

Closed on July 6, 2017, 12:30am UTC


