# Wildcard search Kibana + Filepath + Filename

**URL:** <https://discuss.elastic.co/t/wildcard-search-kibana-filepath-filename/236466>\
**Category:** Kibana\
**Created:** [June 10, 2020, 8:58am UTC](https://discuss.elastic.co/t/wildcard-search-kibana-filepath-filename/236466 "2020-06-10T08:58:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yashwant\_Shettigar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yashwant_shettigar/32/47652_2.png) [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\
**Post date:** [June 10, 2020, 8:58am UTC](https://discuss.elastic.co/t/wildcard-search-kibana-filepath-filename/236466/1 "2020-06-10T08:58:18Z")

</div>

> [@Wildcard query with a file path - Search for c:\\users\\public\*](https://discuss.elastic.co/t/wildcard-query-with-a-file-path-search-for-c-users-public/150384/2):
>
> Hey @uklipse, you'll have to escape the : as well, so event\_data.Image.keyword:c\:\\users\\public\\*

Hello,

There are multiple files present at location supposedly:

/test/1/2/3/file123.txt  
/test/1/2/3/file145.txt  
/test/1/2/3/fileoutput.txt  
/test/1/2/3/fileout123.txt  
/test/1/2/3/file167sdw.txt  
/test/1/2/3/testout123.txt  
/test/1/2/3/testoutput123.txt  
/test/1/2/3/test123.txt

I am trying to run a filter which will help in fetching file which starts with name "file\*" only

Now, I can filter based on filepath, but cant filter it with name.

/test/ \* / \* / \* /file\* - not working  
/test/ \* / \* / \* /(file)\*txt - not working  
/test/ \* / \* / \* /[file]_txt - not working  
/test/ \* / \* / \* /{file}_.txt - not working  
/test/ \* / \* / \* /file?????? - not working

Please help

Thank You

---

<div class="post-metadata">

**Author:** ![mikecote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikecote/32/58549_2.png) [@mikecote](https://discuss.elastic.co/u/mikecote)\
**Post date:** [June 10, 2020, 2:44pm UTC](https://discuss.elastic.co/t/wildcard-search-kibana-filepath-filename/236466/2 "2020-06-10T14:44:10Z")

</div>

Hi @Yashwant_Shettigar,

This sounds like a mapping issue. What is the field mapping in Elasticsearch that is set for filepath?

---

<div class="post-metadata">

**Author:** ![Yashwant\_Shettigar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yashwant_shettigar/32/47652_2.png) [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\
**Post date:** [June 10, 2020, 4:54pm UTC](https://discuss.elastic.co/t/wildcard-search-kibana-filepath-filename/236466/3 "2020-06-10T16:54:54Z")

</div>

Hi Mike,

In index patterns setting, it is set as "String "

While, in mapping as below :

"source": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
},

Thank you

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [June 12, 2020, 6:55am UTC](https://discuss.elastic.co/t/wildcard-search-kibana-filepath-filename/236466/4 "2020-06-12T06:55:48Z")

</div>

With a similar field using our test data containing a URL, I managed to search for a part of the url the following way:

 ![Discover_-_Elastic_und_matthiaswilhelm_kertal-elastic ____projects_kibana__ es_8_0_0_logs](https://us1.discourse-cdn.com/elastic/original/3X/a/e/ae5f691885399b07f9ba5bb740ee55f8a58ea089.png)

If I want this query as a filter, this is also possible:

 ![Discover_-_Elastic](https://us1.discourse-cdn.com/elastic/original/3X/b/e/bed338992d5391797b32b0013e56eb2022ffce87.png)

With your filepath, this should be possible in a similar way. If you need to search for files like in a performant way you could think of using the path hierarchy tokenizer of Elasticsearch when indexing you data: [https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-pathhierarchy-tokenizer-examples.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-pathhierarchy-tokenizer-examples.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2020, 6:55am UTC](https://discuss.elastic.co/t/wildcard-search-kibana-filepath-filename/236466/5 "2020-07-10T06:55:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.