Wildcard search not working for text field

[Nikhil_Utane]

Hi,

I have a text field over which I am doing wildcard search. However it is not working as expected.
Example:

Field: log_message
Value: watchdog watchdog6: watchdog did not stop!

If I use watchd* or watchdog, it matches.
However if I use log_message: "watchdog*stop" (in discover search bar in kibana), it doesn't match and I get 0 hits.
I can make it match with watchdog AND stop but I want to use the wildcard.

This is the mapping for the field:

      "log_message": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "ignore_above": 256
          }
        }
      },

Any idea why the search is not working?

-Regards
Nikhil

[dadoonet (David Pilato)]

Why not just searching for "watchdog stop"?

Anyway this wildcard might work if you search on the keyword subfield instead.

[Nikhil_Utane]

Thanks for your reply.
"watchdog stop" will match exact phrase which is not present here.
Without the quotes it will be OR condition. AND will work.

No, it doesn't work with keyword field. And it shouldn't right?

[dadoonet (David Pilato)]

Sorry. I meant to search for watchdog stop.
That should work whatever the order of the terms is though.

[Nikhil_Utane]

But that would be OR condition, right? I would have to put an AND between the two words.

[dadoonet (David Pilato)]

That's right.

Try then:

+watchdog +stop

[Nikhil_Utane]

That would be similar to AND...just a different syntax.
Any explanation why foo*bar is not working? It is mentioned in reference documents that this should match any phrase, that has foo and bar at the end with anything else in the middle. Thank You.

[dadoonet (David Pilato)]

I think this is because this is considered as a single term then.

Like if you have a term like fooXYZbar then foo*bar will most likely match (on a text field with standard analyzer).
But foo bar is analyzed as ["foo", "bar"] and obviously foo*bar does not match any of those terms.

That's why I'm surprised BTW that the keyword field does not work. But I did not have time yet to check it out.