Wildcard search does not work

Elastic Stack Elasticsearch
1

V7.3.2 in Windows

The following command works. Note "name" is text field.

GET /myindex/_search
{
    "query": {
         "match" : {
             "name": {
                 "query" : "ABCD"
             }
         }
     }
 }

================

But when I try using wildcard, it does not bring any result.
Syntax is from here
https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html

 GET /myindex/_search
 {
     "query": {
         "wildcard": {
             "name": {
                 "value": "AB*D",
                 "boost": 1.0,
                 "rewrite": "constant_score"
             }
         }
     }
 }

=================
If this is caused by wrong setting of search.allow_expensive_queries, how do I check what is current value and where do I set this to true?

2

Could you paste the mapping of the name text field and if it is using any custom analyzers? Also a sample document?

I suspect this is an analysis issue. The match query will pass the query text through the same analyzer that was used to index the document, which means input and output likely match. The wildcard query is a non-analyzed query, meaning it searches the index for exactly the text that you provide.

In practice, most text fields have some kind of analyzer that lowercases, removes punctuation, tokenizes on white space, etc etc. That means a document might have the text ABCD, but after analysis it is stored as abcd.

  • The match query will perform this same analysis, and "ABCD" -> "abcd" which matches.
  • In contrast, the wildcard query does no analysis, so it is looking for "AB", any number of characters, followed by "D". This doesn't exist in the index because the document was stored as "abcd", so the query fails to match

I'm not sure that is what's happening, but something along that lines is most likely.

3

@polyfractal -

Resolved. Thanks for your explanation. I changed value as lowercase in query and then query brings back results as expected.

Checked mapping -

"name" : {
          "type" : "text",
          "index_options" : "offsets"
        },

Also found these settings from Mapping

"settings" : {
      "index" : {
        "number_of_shards" : "5",
        "provided_name" : "XXXXXXX",
        "gc_deletes" : "24h",
        "creation_date" : "1578423989207",
        "analysis" : {
          "analyzer" : {
            "keyword_lowercase" : {
              "filter" : [
                "lowercase"
              ],
              "type" : "custom",
              "tokenizer" : "keyword"
            }
          }
        },
4

Awesome, glad you sorted it out! :slight_smile:

Analyzed vs non-analyzed is a tricky thing that catches a lot of people up. In the docs, anything that is a Fulltext query will be analyzed with the configured analyzer (which tends to make them more "user-friendly" for query bars and end-users, etc)... while pretty much all the other queries are non-analyzed and looking at byte-for-byte matches in the index.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.