Wildcard is not working as expected

Elastic Stack Elasticsearch
1

Hello,

I am using "wildcard" for matching fields of type text with a specific pattern.

    "query": {
        "wildcard": {
            "description": {
                "value": "objective*",
                "case_insensitive": true,
            }
        }
    }
}

It should only match descriptions like "objective: To monitor...". But, it is also matching descriptions like "Target: the objective of ..."

Basically, its performing search for objective instead of objective*.

I tried using query_string, regexp inplace of wildcard but they are not working.

mapping of the column is as follows:

"description": {
    "fields": {
        "keyword": {
            "ignore_above": 256,
            "type": "keyword"
       }
    },
    "type": "text"
}
2

Hello @venkatesh_aamanchi,
I think in this case you'll need to use the prefix query (see docs). With the prefix query you can search a field that starts with objective.
Your query should look something like:

GET /_search
{
  "query": {
    "prefix": {
      "description": {
        "value": "objective",
        "case_insensitive": true
      }
    }
  }
}```
3

You need to search within the description.keyword field instead. As the description field is analyzed and broken into tokens.

4

Hi @piergm, Thanks for the response. "prefix" is used check against text to see if there are any words that start with the value that was provided in query. It does not work in this. But, I still tried and result is same as "objective".

Any idea why wildcard is not working properly in my case?

5

The wildcard character means 0 or more characters of any type, so is working as expected. To get the result you want you may need to search the keyword field for *objective:*, but be aware that this type of wildcard queries can be very slow.

6

@dadoonet The combination of wildcard with description.keyword actually worked. Thank you

7

@Christian_Dahlqvist I am new to elasticsearch. But, wildcard is supposed to match the pattern right? Actually, I tried query "query_string" and "regex" in place of wildcard, the search still yielded wrong results.

8

It will depend onthe mapping of the field. If you are querying a field mapped as text the tokens will be indexed individually. I believe the default analyser will remove certain characters, so objective: will be indexed as objective. If you search for objective* the wildcard means 0 or more characters and you get the matches you see. When you search the field mapped as keyword the whole string is indexed as a single token. If you now search for objective* you will only find matched that start with objective and have any number of additional characters (incuding 0 additional characters).

If you think in terms of regular expressions I believe objective* in a wildcard query is equivalent to $objective.*.