# Wirldcard search issue

**URL:** <https://discuss.elastic.co/t/wirldcard-search-issue/65347>\
**Category:** Kibana\
**Created:** [November 8, 2016, 12:03pm UTC](https://discuss.elastic.co/t/wirldcard-search-issue/65347 "2016-11-08T12:03:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Post date:** [November 8, 2016, 12:03pm UTC](https://discuss.elastic.co/t/wirldcard-search-issue/65347/1 "2016-11-08T12:03:55Z")

</div>

Hi all,

I'm facing an issue when I try to search like below in Kibana interface:

(for information, the host field is analyzed and the short\_message field is not\_analyzed)

The string in the shot\_message field: "_Port Manager Internal Software Error (pm\_vtpvlan\_bitlist\_test(&operInfo.trunkVlans, vlan)_"

> host:"test.corp" AND short\_message:\*Internal\* -\> I didn't get any result

but with

> host:"test.corp" AND short\_message:\*nternal\* -\> I get a result

I don't understand why ? Why when I leave the "I" it works otherwise it doens't work ?

When I issue a GET command like below, it works:

```
... 
"query": {
        "query_string": {
          "query": "host:\"test.corp\"",
          "analyze_wildcard": true
           }
  },
  "query": {
        "wildcard": {
            "short_message": "\*Internal\*"
        }
  },
...

```

I'm interesting if anyone have the solution. Because right now i'm not able to perform a wildcar search on a not\_analyzed field through Kibana.

Thanks in advance,  
Alex

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [November 8, 2016, 10:19pm UTC](https://discuss.elastic.co/t/wirldcard-search-issue/65347/2 "2016-11-08T22:19:45Z")

</div>

Have you looked at the request being sent to elasticsearch when you perform this search? If you click on the arrow to the bottom-left of the bar chart on the discover page, it should reveal a panel that shows you information about the request, including the query that ends up being sent to elasticsearch. Could you copy that here?

---

<div class="post-metadata">

**Author:** ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Post date:** [November 9, 2016, 12:07pm UTC](https://discuss.elastic.co/t/wirldcard-search-issue/65347/3 "2016-11-09T12:07:20Z")

</div>

Hi,

There is no panel to see the request when I get "No results found". When I get a result I can see the request sent to elasticsearch.

But I did a tcpdump, find below the request **working** :

```
...
{
"size":500,
"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],
    "query":{
         "filtered":{
             "query":{
                 "query_string":{
                     "analyze_wildcard":true,
                     "query":"host:\"test.corp\" AND short_message:*nternal*"
                 }
             },
...

```

And below the request **not working** :

```
...
{
"size":500,
"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],
    "query":{
         "filtered":{
             "query":{
                 "query_string":{
                     "analyze_wildcard":true,
                     "query":"host:\"test.corp\" AND short_message:*Internal*"
                 }
             },
...

```

Thanks in advance,  
Alex

---

<div class="post-metadata">

**Author:** ![lukas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas/32/6812_2.png) [@lukas](https://discuss.elastic.co/u/lukas)\
**Post date:** [November 11, 2016, 4:09pm UTC](https://discuss.elastic.co/t/wirldcard-search-issue/65347/4 "2016-11-11T16:09:25Z")

</div>

My guess is that this has something to do with the fact that your `short_message` field is not analyzed. I'm not exactly sure why the latter isn't providing results, but the Elasticsearch sub-forum may be of more help to you.

What I can tell you is that, if you'd like, you are able to paste in entire search queries. For example, you can copy the following JSON and paste it in the search bar, and tweak if necessary:

```
{
  "query_string": {
    "query": "host:\"test.corp\"",
    "analyze_wildcard": true
  }
}
```

---

<div class="post-metadata">

**Author:** ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)\
**Post date:** [November 15, 2016, 5:51pm UTC](https://discuss.elastic.co/t/wirldcard-search-issue/65347/5 "2016-11-15T17:51:43Z")

</div>

Thanks a lot ! I will try.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2016, 5:52pm UTC](https://discuss.elastic.co/t/wirldcard-search-issue/65347/6 "2016-12-13T17:52:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.