# Wildcard search not working for text field

**URL:** <https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520>\
**Category:** Elasticsearch\
**Created:** [June 12, 2018, 11:08am UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520 "2018-06-12T11:08:33Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nikhil\_Utane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikhil_utane/32/27547_2.png) [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\
**Post date:** [June 12, 2018, 11:08am UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/1 "2018-06-12T11:08:33Z")

</div>

Hi,

I have a text field over which I am doing wildcard search. However it is not working as expected.  
Example:

> Field: log\_message  
> Value: watchdog watchdog6: watchdog did not stop!

If I use _watchd_\* or _watchdog_, it matches.  
However if I use _log\_message: "watchdog\*stop"_ (in discover search bar in kibana), it doesn't match and I get 0 hits.  
I can make it match with watchdog AND stop but I want to use the wildcard.

This is the mapping for the field:

> ```
> "log_message": {
> "type": "text",
> "fields": {
> "keyword": {
> "type": "keyword",
> "ignore_above": 256
> }
> }
> },
> 
> ```

Any idea why the search is not working?

-Regards  
Nikhil

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 12, 2018, 11:24am UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/2 "2018-06-12T11:24:34Z")

</div>

Why not just searching for "watchdog stop"?

Anyway this wildcard might work if you search on the keyword subfield instead.

---

<div class="post-metadata">

**Author:** ![Nikhil\_Utane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikhil_utane/32/27547_2.png) [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\
**Post date:** [June 12, 2018, 12:04pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/3 "2018-06-12T12:04:53Z")

</div>

Thanks for your reply.  
"watchdog stop" will match exact phrase which is not present here.  
Without the quotes it will be OR condition. AND will work.

No, it doesn't work with keyword field. And it shouldn't right?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 12, 2018, 12:18pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/4 "2018-06-12T12:18:54Z")

</div>

Sorry. I meant to search for `watchdog stop`.  
That should work whatever the order of the terms is though.

---

<div class="post-metadata">

**Author:** ![Nikhil\_Utane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikhil_utane/32/27547_2.png) [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\
**Post date:** [June 12, 2018, 12:23pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/5 "2018-06-12T12:23:30Z")

</div>

But that would be OR condition, right? I would have to put an AND between the two words.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 12, 2018, 12:48pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/6 "2018-06-12T12:48:04Z")

</div>

That's right.

Try then:

```
+watchdog +stop
```

---

<div class="post-metadata">

**Author:** ![Nikhil\_Utane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikhil_utane/32/27547_2.png) [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\
**Post date:** [June 13, 2018, 4:05am UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/7 "2018-06-13T04:05:53Z")

</div>

That would be similar to AND...just a different syntax.  
Any explanation why foo\*bar is not working? It is mentioned in reference documents that this should match any phrase, that has foo and bar at the end with anything else in the middle. Thank You.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 13, 2018, 4:19am UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/8 "2018-06-13T04:19:47Z")

</div>

I think this is because this is considered as a single term then.

Like if you have a term like `fooXYZbar` then `foo*bar` will most likely match (on a text field with standard analyzer).  
But `foo bar` is analyzed as `["foo", "bar"]` and obviously `foo*bar` does not match any of those terms.

That's why I'm surprised BTW that the `keyword` field does not work. But I did not have time yet to check it out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2018, 4:19am UTC](https://discuss.elastic.co/t/wildcard-search-not-working-for-text-field/135520/9 "2018-07-11T04:19:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.