# Those wildcard searches... or is it me?

**URL:** <https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055>\
**Category:** Elasticsearch\
**Created:** [October 11, 2018, 1:16pm UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055 "2018-10-11T13:16:54Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![waltus](https://avatars.discourse-cdn.com/v4/letter/w/96bed5/32.png) [@waltus](https://discuss.elastic.co/u/waltus)\
**Post date:** [October 11, 2018, 1:16pm UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055/1 "2018-10-11T13:16:54Z")

</div>

Hi, guys my third time setting up all the good things:  
Elasticsearch, Logstash, Kibana... Logs coming from Filebeat.  
Kibana is showing me all the relevant Logs. I also fixed the timestamp situation. ..  
Everything looks awesome. I was proud!  
But now, where Boss is testing it: all RegEx related Search Options are not working. 😕  
e.g.:  
request: "/somedata/somewhere/here.html" ..  
request: "/somedata/wheresome/here.html" ..  
..

I want to search in kibana something like this: "/somedata/\*/here.html", which should replay both, right?  
..but it shows me nothing. yes, i have escaped every symbol proper etc.  
Is somewhere a nice guide on how to make the classic wildcard-search ( "\*", "?", ..) functional?  
In other words:  
How to apply the right analyzer to make wildcard-searches within the request fields working?

Thanks Guys. And Sorry for mistakes. Iam new here. 🙈

---

<div class="post-metadata">

**Author:** ![waltus](https://avatars.discourse-cdn.com/v4/letter/w/96bed5/32.png) [@waltus](https://discuss.elastic.co/u/waltus)\
**Post date:** [October 25, 2018, 1:03pm UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055/2 "2018-10-25T13:03:45Z")

</div>

Thanks for this amazing input, guys. Thanks.

Could someone explain to me the following please:

`"/somedata/*/here.html"` gives zero feedback,  
`"\/somedata\/*\/here\.html"` gives zero feedback,  
`/somedata/*/here.html` gives some feedback but not the right one,  
`request: ""/somedata/*/here.html""` zero feedback,  
`request: ""\/somedata\/*\/here\.html""` zero feedback,  
`request.keyword: "/somedata/*/here.html"` zero feedback,

but  
`{"wildcard": {"request.keyword": "*\\/somedata\\/*\\/here\\.html"}}`  
works as it should be. thats weird.

Is it possible to use the term "{"wildcard": {"request.keyword": " as a default for the kibana searchbar?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![tamara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamara/32/47095_2.png) [@tamara](https://discuss.elastic.co/u/tamara)\
**Post date:** [October 25, 2018, 2:10pm UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055/3 "2018-10-25T14:10:55Z")

</div>

Hi,

You can change the default field at the Discover like:

KIbana-\>Management-\>Advanced Settings

and change the default\_field at **query:queryString:options**

Now about the wildcards. If you want to search you should use like this:

`request.keyword:\/somedata\/*\/here\.html`

Don't use the quotes because this will be interpreter as a exact match and won't execute the wildcard.

You can also use regular expressions in Kibana like this:

`request.keyword:/\/somedata\/.*\/here\.html/`

---

<div class="post-metadata">

**Author:** ![waltus](https://avatars.discourse-cdn.com/v4/letter/w/96bed5/32.png) [@waltus](https://discuss.elastic.co/u/waltus)\
**Post date:** [October 25, 2018, 3:34pm UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055/4 "2018-10-25T15:34:36Z")

</div>

Hi. Thanks for your reply.  
sadly: your given Options are giving me ZERO hits. 😕  
It only works if i post it like this in kibana:  
`{"wildcard": {"request.keyword": "*\\/somedata\\/*\\/here\\.html"}}`

---

<div class="post-metadata">

**Author:** ![waltus](https://avatars.discourse-cdn.com/v4/letter/w/96bed5/32.png) [@waltus](https://discuss.elastic.co/u/waltus)\
**Post date:** [October 26, 2018, 9:55am UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055/5 "2018-10-26T09:55:32Z")

</div>

What is the magic behind your recommendations?  
Even the official documentation tells me, that RegEx-stuff could be realized through "/" at the beginning and end. But no luck for me 😕  
For futher error analysis: Should I post my mapping?  
Thanks in Advance.

---

<div class="post-metadata">

**Author:** ![tamara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamara/32/47095_2.png) [@tamara](https://discuss.elastic.co/u/tamara)\
**Post date:** [October 26, 2018, 4:51pm UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055/6 "2018-10-26T16:51:48Z")

</div>

Hi, I have notice that it was wrong the regular expression example that I have sent to you.

The documentaiton about the what is accepted in Kibana is in here (change for your version of Kibana):  
[https://www.elastic.co/guide/en/kibana/current/lucene-query.html](https://www.elastic.co/guide/en/kibana/current/lucene-query.html)

Here the link for the Query String syntax:  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax)

You can try the follwing steps to see how it work the wild card and the regular expression.

Add this index

```
POST test/_doc/_bulk
{"index" : {"_id": "1"}}
{ "path": "/something/to/search/search.html" }
{"index" : {"_id": "2"}}
{ "path": "/nothing/to/search/new.html" }
{"index" : {"_id": "3"}}
{ "path": "/something/to/view/other.html" }
{"index" : {"_id": "4"}}
{ "path": "/not/to/search/search.html" }

```

Add index pattern in the Kibana-\>Managemnt-\>Index Patterns

Now try in the Discover the following (change to the right index pattern)

Regular Expression  
`path.keyword:/\/some.*/` - 2 hits  
`path.keyword:/\/some.*\/search.*/` - 1 hit

Wild Card  
`path.keyword:\/some*` - 2 hits  
`path.keyword:\/some*\/search*` - 1 hit

Hope you could understand better how it works.

If you still can not make the searches send me the mapping and examples of documentsand, and I help you to make the search in the Discover. 🙂

---

<div class="post-metadata">

**Author:** ![waltus](https://avatars.discourse-cdn.com/v4/letter/w/96bed5/32.png) [@waltus](https://discuss.elastic.co/u/waltus)\
**Post date:** [October 29, 2018, 9:50am UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055/7 "2018-10-29T09:50:33Z")

</div>

Hi and thanks for anwsering again,  
thank you very much.  
And yes, your example is delivering the correct hits.

On my own index it is not working. 😕  
I have sent you my mapping as a private message, would be awesome if you could tell me whats wrong with it. THANKS.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2018, 9:50am UTC](https://discuss.elastic.co/t/those-wildcard-searches-or-is-it-me/152055/8 "2018-11-26T09:50:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.