# Wildcard query over \_all field on Elasticsearch 5 failed

**URL:** https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315
**Category:** Elasticsearch
**Created:** [November 28, 2016, 8:55am UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315 "2016-11-28T08:55:52Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Benjamin\_Dupre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_dupre/32/13245_2.png) [@Benjamin\_Dupre](https://discuss.elastic.co/u/Benjamin_Dupre)
#### Post date: [November 28, 2016, 8:55am UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315/1 "2016-11-28T08:55:52Z")

</div>

Hi the following query is not working anymore with ES 5.0 :

```
GET g_contents/_search
{
  "query": {
              "wildcard" : {
                "_all" : {
                  "wildcard" : "*doc*",
                  "boost": 1
                }
              }
            }
      }

```

Are they anyway to get the same result with ES 5?

Regards,  
Benjamin Dupré

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 28, 2016, 9:08am UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315/2 "2016-11-28T09:08:15Z")

</div>

First of all, that's a very bad idea. It's one of the worse query you can send to elasticsearch.  
Similar to a full scan table you have in SQL databases.

Can you tell what is the error message you are getting?

---

<div class="post-metadata">

### Author: ![Benjamin\_Dupre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_dupre/32/13245_2.png) [@Benjamin\_Dupre](https://discuss.elastic.co/u/Benjamin_Dupre)
#### Post date: [November 28, 2016, 1:54pm UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315/3 "2016-11-28T13:54:22Z")

</div>

Hi David,  
Yes i know that's a terrible for performance but it's limited to a small index size.

the error is :

```
{
  "error": {
    "root_cause": [
      {
        "type": "query_shard_exception",
        "reason": "failed to create query: {\n \"wildcard\" : {\n \"_all\" : {\n \"wildcard\" : \"Keepin*\",\n \"boost\" : 1.0\n }\n }\n}",
        "index_uuid": "ROGUdIGxRlOx-7EP8N0Xfw",
        "index": "g_contents"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "g_contents",
        "node": "YmywysnqRle3qc953VBvxg",
        "reason": {
          "type": "query_shard_exception",
          "reason": "failed to create query: {\n \"wildcard\" : {\n \"_all\" : {\n \"wildcard\" : \"Keepin*\",\n \"boost\" : 1.0\n }\n }\n}",
          "index_uuid": "ROGUdIGxRlOx-7EP8N0Xfw",
          "index": "g_contents",
          "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.all.AllTermQuery: _all:Keepin*"
          }
        }
      }
    ],
    "caused_by": {
      "type": "query_shard_exception",
      "reason": "failed to create query: {\n \"wildcard\" : {\n \"_all\" : {\n \"wildcard\" : \"Keepin*\",\n \"boost\" : 1.0\n }\n }\n}",
      "index_uuid": "ROGUdIGxRlOx-7EP8N0Xfw",
      "index": "g_contents",
      "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.all.AllTermQuery: _all:Keepin*"
      }
    }
  },
  "status": 400
}
```

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 30, 2016, 10:05am UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315/4 "2016-11-30T10:05:34Z")

</div>

I see and I can reproduce. I'm not sure if it's expected. @jpountz WDYT? Should we open an issue?

---

<div class="post-metadata">

### Author: ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)
#### Post date: [November 30, 2016, 10:28am UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315/5 "2016-11-30T10:28:39Z")

</div>

That looks like a bug indeed!

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [November 30, 2016, 11:25am UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315/6 "2016-11-30T11:25:17Z")

</div>

@Benjamin_Dupre could you open an issue with all the details you sent already and link to this thread?

Thanks!

---

<div class="post-metadata">

### Author: ![Benjamin\_Dupre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benjamin_dupre/32/13245_2.png) [@Benjamin\_Dupre](https://discuss.elastic.co/u/Benjamin_Dupre)
#### Post date: [November 30, 2016, 1:22pm UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315/7 "2016-11-30T13:22:36Z")

</div>

Ok , i've opened the [Issue](https://github.com/elastic/elasticsearch/issues/21882)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 28, 2016, 1:22pm UTC](https://discuss.elastic.co/t/wildcard-query-over--all-field-on-elasticsearch-5-failed/67315/8 "2016-12-28T13:22:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
