# Using Wildcards in field filters

**URL:** <https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329>\
**Category:** Kibana\
**Created:** [April 14, 2016, 12:38am UTC](https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329 "2016-04-14T00:38:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Whitmarsh](https://avatars.discourse-cdn.com/v4/letter/b/3ab097/32.png) [@Bryan\_Whitmarsh](https://discuss.elastic.co/u/Bryan_Whitmarsh)\
**Post date:** [April 14, 2016, 12:38am UTC](https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329/1 "2016-04-14T00:38:21Z")

</div>

Ok, I'm a elastic newbie (\<8hrs and 100+ usages of "curl -XDELETE '[http://localhost:9200/\_all](http://localhost:9200/_all)'"...;).  
I simply want to create a filter that searches the string content of a specific field (POND\_NAME) and returns all records that start with "BABING". I've tried all the flavors of POND\_NAME:BABINGTON\* possible but none seem to work. What am I doing wrong? This should be simple!

 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/0de8782fa23b0b59529c4f46815477b0361952bf.png)  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3bd9ebefc2cbe40b0858aa67baa19f9fed0f39ac.png)

This works:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/010b10f935e11cb51d40bd5fcc9acb17395b9ac1.png)

This Doesn't:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e5599fb230a82195b3e30556bce1a967d42f6fbc.png)

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 14, 2016, 1:59am UTC](https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329/2 "2016-04-14T01:59:35Z")

</div>

Not sure if it has something to do with using wildcard on a **not\_analyzed** field

---

<div class="post-metadata">

**Author:** ![Bryan\_Whitmarsh](https://avatars.discourse-cdn.com/v4/letter/b/3ab097/32.png) [@Bryan\_Whitmarsh](https://discuss.elastic.co/u/Bryan_Whitmarsh)\
**Post date:** [April 14, 2016, 2:07am UTC](https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329/3 "2016-04-14T02:07:31Z")

</div>

I had to set the field as not\_analyzed because the multi-name pond names were getting broken up into multiple different ponds. For example "BABINGTON C4" became two ponds "BABINGTON" and "C4"...

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 14, 2016, 5:13pm UTC](https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329/5 "2016-04-14T17:13:52Z")

</div>

It may not be the not\_analyzed field. I'm curious about this too so I did a test on two fields in my netflow data:

Mappings:

```auto
"IPV4_SRC_ADDR": {
        "include_in_all": true,
        "index": "not_analyzed",
        "type": "string"
      },
"L7_PROTO_NAME": {
        "include_in_all": true,
        "index": "not_analyzed",
        "type": "string"
      }

```

`IPV4_SRC_ADDR` contains IP such as 10.0.0.1, 10.0.0.2, 192.168.0.10, etc.  
`L7_PROTO_NAME` contains protocol name such as SSL, HTTP, HTTPS, DNS, SSL.Google

Using wildcard on both fields, I can successfully get result for

> IPV4\_SRC\_ADDR:10.0.\*

which shows me 10.0.0.1 and 10.0.0.2, but when I run for `L7_PROTO_NAME`

> L7\_PROTO\_NAME: "HTTP\*"

then no result shows up

I don't know why I got different behaviors with wildcard search on the same field type and `not_analyzed`?

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [April 14, 2016, 5:17pm UTC](https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329/6 "2016-04-14T17:17:09Z")

</div>

In you case you can either use include\_in\_all for `POND_NAME` field and use wildcard search in `_all` field, or you can use multi fields for `POND_NAME`

```auto
"POND_NAME": {
          "index": "analyzed",
          "type": "string",
          "fields": {
            "raw": {
              "index": "not_analyzed",
              "type": "string",
            }
          }
        },

```

`POND_NAME`for searching and `POND_NAME.raw` for aggregation

---

<div class="post-metadata">

**Author:** ![Bryan\_Whitmarsh](https://avatars.discourse-cdn.com/v4/letter/b/3ab097/32.png) [@Bryan\_Whitmarsh](https://discuss.elastic.co/u/Bryan_Whitmarsh)\
**Post date:** [April 18, 2016, 6:40pm UTC](https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329/7 "2016-04-18T18:40:18Z")

</div>

Thank you! That's going to work for me. I use the "analyzed" POND\_NAME field to filter with wildcards and I use the "non-analyzed" field POND\_NAME.raw to query by POND NAME.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:55pm UTC](https://discuss.elastic.co/t/using-wildcards-in-field-filters/47329/8 "2017-07-06T13:55:46Z")

</div>