Searching on text fields using wildcard

Elastic Stack Elasticsearch
1

Hello,
I have simple question about searching on text field.

Let's assume we have a text field message with value:
This is example of search query. Can anyone help me?

PUT index
{
  "mappings": {
    "properties": {
      "message" : {
        "type" : "text"
      }
    }
  }
}

POST index/_doc
{
  "message": "This is example of search query. Can anyone help me?"
}

I'm using standard analyzer. So sentence is tokenized like this:

POST _analyze
{
  "text": "This is example of search query. Can anyone help me?",
  "analyzer": "standard"
}

I found out that wildcard is possible to apply only on tokenized terms.

POST index/_search
{
  "query": {
    "query_string": {
      "default_field": "message",
      "query": "s*r*h"
    }
  }
}

and

GET index/_search
{
  "query": {
    "wildcard": {
      "message": {
        "value": "s*r*h*"
      }
    }
  }
}

and

GET index/_search
{
  "query": {
    "regexp": {
      "message": {
        "value": "s.*ch",
        "flags": "ALL"
      }
    }
  }
}

Is it possible to perform query on field message that will met these requirements?

  1. field begins with tokens this, is
  2. somewhere after these tokens is token that
  3. field ends with token me

or is necessary to index field message as keyword type too and perform regexp query like: /^This is.*that.*me/

2

If you’re always searching for whole-words in a sequence then interval queries on a text field would work.

Keyword field would allow for whole-value matching using regex or wildcard, however in recently released 7.9 we have what may be a better option https://www.elastic.co/blog/find-strings-within-strings-faster-with-the-new-elasticsearch-wildcard-field

3

Thank you @Mark_Harwood for explanation.

The interval queries are possible only with DSL?
Is it possible to perform interval queries by KQL or Lucene Query?

4

Yes. If I recall correctly the Kibana search bar accepts DSL if you have the "Lucene" syntax option enabled - you search string just has to be JSON so starting with a {

KQL and Lucene both support basic phrase queries if you put quotes around words e.g. "this that" but I think only the Lucene syntax supports the slop operator that dictates how many positions apart the words can be e.g. "this that"~2.
Neither of these support the more advanced features interval queries offer e.g. the ability to search for this or that near something else..

5

Great! I can confirm that DLS works in Kibana when Lucene syntax is enabled.

{"bool":{"must":[{"match":{"code":200}}]}}