Use multiple wildcards DSL Query

[lutundula_jeanchris]

Hello everyone , I just started using "DSL query" on my ELK platform and i want to make a DSL request that can use wildcard to perform matching search . my request will find all the mail_domain (term) that end with "mail.com" , "test.com" , "email.com" basically a list of domains , and dsplay them .

Here's my resquest

{
"query": {
"wildcard": {
"mail_domain.keyword": ["*mail.com" , "*email.com" , "*test.com"]
}
}
}

it seems like wilcard can't take an array of a term values . Do you have any idea how can i do it ?

Thanks

[ppisljar (Peter Pisljar)]

This looks like a really bad idea. Elasticsearch will need to go thru every document to find those matches. To do this right you will need to index your data appropriately. Maybe add a domain field (with mail.com, email.com, ... values), or even a simple boolean field isMyMatchedEmailDomain

you could also use https://www.elastic.co/guide/en/elasticsearch/reference/6.2/analysis-reverse-tokenfilter.html to optimize your index for prefix wildcard searches

[lutundula_jeanchris]

Thanks man