# Wildcard search on raw not\_analyzed field **URL:** \ **Category:** Elasticsearch\ **Created:** [January 26, 2015, 11:04pm UTC](https://discuss.elastic.co/t/wildcard-search-on-raw-not-analyzed-field/21841 "2015-01-26T23:04:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![BradVido](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradvido/32/741_2.png) [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Post date:** [January 26, 2015, 11:04pm UTC](https://discuss.elastic.co/t/wildcard-search-on-raw-not-analyzed-field/21841/1 "2015-01-26T23:04:44Z")
I have a dynamic template that sets up not\_analyzed raw mappings for all my string fields. When I perform a query search like this: field.raw=KnownValue it works (has hits). When I do this: field.raw=Known?alue it doesn't return any data (? wildcard doesn't work). However, field.raw=\* does return data. What am I missing? Does it have to do with case-sensitivity? Here is the dynamic template: { "string\_fields": { "mapping": { "index": "analyzed", "type": "string", "fields": { "raw": { "index": "not\_analyzed", "ignore\_above": 256, "doc\_values": true, "type": "string" } } }, "match": "\*", "match\_mapping\_type": "string" } } -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1a6d1de1-c08a-40f5-96f9-26f7a217b7b7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1a6d1de1-c08a-40f5-96f9-26f7a217b7b7%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![drull](https://avatars.discourse-cdn.com/v4/letter/d/b77776/32.png) [@drull](https://discuss.elastic.co/u/drull)\ **Post date:** [January 28, 2015, 10:51am UTC](https://discuss.elastic.co/t/wildcard-search-on-raw-not-analyzed-field/21841/2 "2015-01-28T10:51:08Z")
First of all you have to use "regexp" filter or query, not "match". If you mean any character between "Known" and "alue", you have to use dot instead of question mark. "Known?alue" means "Know" + ("n" or nothing) + "alue". "Known.alue" means "Known" + any character + "alue". Like this: { "query" : { "filtered" : { "query" : { "match\_all" : {} }, "filter" : { "bool" : { "must" : [{ "regexp" : {"your\_field\_name": "Known.alue"} }] } } } }, "from" : 0, "size" : 20 } On Tuesday, January 27, 2015 at 1:04:44 AM UTC+2, BradVido wrote: > I have a dynamic template that sets up not\_analyzed raw mappings for all > my string fields. > > When I perform a query search like this: > field.raw=KnownValue > it works (has hits). > > When I do this: > field.raw=Known?alue > it doesn't return any data (? wildcard doesn't work). > > However, > field.raw=\* > does return data. > > What am I missing? Does it have to do with case-sensitivity? > > Here is the dynamic template: > { > "string\_fields": { > "mapping": { > "index": "analyzed", > "type": "string", > "fields": { > "raw": { > "index": "not\_analyzed", > "ignore\_above": 256, > "doc\_values": true, > "type": "string" > } > } > }, > "match": "\*", > "match\_mapping\_type": "string" > } > } -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/bb8cf127-8a50-44cb-b739-430834400f6b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/bb8cf127-8a50-44cb-b739-430834400f6b%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![BradVido](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradvido/32/741_2.png) [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Post date:** [January 28, 2015, 1:58pm UTC](https://discuss.elastic.co/t/wildcard-search-on-raw-not-analyzed-field/21841/3 "2015-01-28T13:58:21Z")
I am already doing a query text search. I'm expecting the ? to match a single character. It works on the regular, analyzed, field, just not the .raw not\_analyzed version. That's why i'm confused -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/88040a4f-cfa5-4732-9800-64a176e9a4d4%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/88040a4f-cfa5-4732-9800-64a176e9a4d4%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![BradVido](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradvido/32/741_2.png) [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Post date:** [March 31, 2015, 7:22pm UTC](https://discuss.elastic.co/t/wildcard-search-on-raw-not-analyzed-field/21841/4 "2015-03-31T19:22:52Z")
I need help determining how wildcard matching for non\_analyzed fields works. I have a field `message` with this mapping defined: "message" : { "type" : "string", "norms" : { "enabled" : false }, "fields" : { "raw" : { "type" : "string", "index" : "not\_analyzed", "doc\_values" : true, "ignore\_above" : 256 } } } I've indexed a document that has this data: {"message": "Failed to connect"} I'm executing a Query String Query, and here are the results: message.raw:Failed\* No matches message.raw:failed\* No matches message.raw:?ailed\* Match found! Why don't the first two match? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/f55a7497-3bbe-4d32-bf27-89fc3a4533bc%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/f55a7497-3bbe-4d32-bf27-89fc3a4533bc%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![BradVido](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradvido/32/741_2.png) [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Post date:** [March 31, 2015, 7:44pm UTC](https://discuss.elastic.co/t/wildcard-search-on-raw-not-analyzed-field/21841/5 "2015-03-31T19:44:34Z")
Update, it seems that the problem is lowercase\_expanded\_terms defaults to true. Setting it to false in my query returned results for the first two queries. On Monday, January 26, 2015 at 5:04:44 PM UTC-6, BradVido wrote: > I have a dynamic template that sets up not\_analyzed raw mappings for all > my string fields. > > When I perform a query search like this: > field.raw=KnownValue > it works (has hits). > > When I do this: > field.raw=Known?alue > it doesn't return any data (? wildcard doesn't work). > > However, > field.raw=\* > does return data. > > What am I missing? Does it have to do with case-sensitivity? > > Here is the dynamic template: > { > "string\_fields": { > "mapping": { > "index": "analyzed", > "type": "string", > "fields": { > "raw": { > "index": "not\_analyzed", > "ignore\_above": 256, > "doc\_values": true, > "type": "string" > } > } > }, > "match": "\*", > "match\_mapping\_type": "string" > } > } -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8b081a6d-ad56-497f-851c-abd34b7db916%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8b081a6d-ad56-497f-851c-abd34b7db916%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:22am UTC](https://discuss.elastic.co/t/wildcard-search-on-raw-not-analyzed-field/21841/6 "2017-07-06T00:22:37Z")