# Use wildcard data type ,The number of events does not match when querying

**URL:** <https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318>\
**Category:** Elasticsearch\
**Created:** [September 3, 2020, 3:08am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318 "2020-09-03T03:08:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![woxiang-H](https://avatars.discourse-cdn.com/v4/letter/w/e9bcb4/32.png) [@woxiang-H](https://discuss.elastic.co/u/woxiang-H)\
**Post date:** [September 3, 2020, 3:08am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318/1 "2020-09-03T03:08:26Z")

</div>

I use two field types: text and wildcard to store the same error log. When I query, I find the missing content

```auto
GET test-wildcard/_search
{
  "query": {
    "match": {
      "json.thrown.stack": "*invokeWithoutCircuitBreaker$LOG4X*"
    }
  }
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/e/ae346dcc0293aaaac440568ae030a48de68e5a10.png)

```auto
GET test-text/_search
{
  "query": {
    "match": {
      "json.thrown.stack": "invokeWithoutCircuitBreaker$LOG4X"
    }
  }
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/7/07d3dcb10d88ae23b638b0141387e8ce716d9f29.png)

Is my query method wrong or the problem caused by the wildcard field type?

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [September 3, 2020, 8:59am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318/2 "2020-09-03T08:59:07Z")

</div>

Hi.  
`match` query doesn't support wildcard syntax.  
Try

```
{
	"query": {
		"wildcard": {
			"json.thrown.stack": {
				"value":"*invokeWithoutCircuitBreaker$LOG4X*"
			}
		
		}
	}
}
```

---

<div class="post-metadata">

**Author:** ![woxiang-H](https://avatars.discourse-cdn.com/v4/letter/w/e9bcb4/32.png) [@woxiang-H](https://discuss.elastic.co/u/woxiang-H)\
**Post date:** [September 3, 2020, 9:37am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318/3 "2020-09-03T09:37:09Z")

</div>

Thanks for your reply !

I tried the wildcard syntax, but the result is the same, there is still a difference with the result of the text field type search.

```auto
GET test-wildcard/_search
{
  "query": {
    "wildcard": {
      "json.thrown.stack": {
        "value": "*invokeWithoutCircuitBreaker$LOG4X*"
      }
    }
  }
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/0/50a59a8bcfebbe7ec6d46dc02ad54829eb8c6da1.png)

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [September 3, 2020, 9:44am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318/4 "2020-09-03T09:44:16Z")

</div>

> [@woxiang-H](#):
>
> there is still a difference with the result of the text field type search.

That's because the query/field combos are doing fundamentally different things.

One is an exact search for an exact sequence of characters (wildcard query on wildcard field)

The other is matching _any_ word in a list of presented words (match query on text field). The words are potentially stripped of case differences and separated by characters determined by the text field's choice of Analyzer.

---

<div class="post-metadata">

**Author:** ![woxiang-H](https://avatars.discourse-cdn.com/v4/letter/w/e9bcb4/32.png) [@woxiang-H](https://discuss.elastic.co/u/woxiang-H)\
**Post date:** [September 3, 2020, 9:56am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318/5 "2020-09-03T09:56:45Z")

</div>

That's right !  
The wildcard field does not ignore case, so the returned results will look different.  
Thanks for helping me out ！

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [September 3, 2020, 10:01am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318/6 "2020-09-03T10:01:03Z")

</div>

No problem.  
We are working on adding case insensitive search options.  
For now you can use a `regexp` query instead of the wildcard and list each character with its allowed variants e.g. `Case` becomes `[Cc][Aa][Ss][Ee]`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2020, 10:01am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318/7 "2020-10-01T10:01:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.