How to use wildcard in elastic query?

Question

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "timestamp": {
              "gte": "now-30m/m"
            }
          }
        },
        {
          "match": {
            "type": "ERROR"
          }
        },
        {
          "wildcard": {
            "Name": "*Rajesh*"
          }
        },
        {
          "wildcard": {
            "Name": "*Shiv*"
          }
        }
      ]
    }
  }
}

I want search in the name field using wildcard that matches any of the two wildcard values (Rajesh,Shiv).And i need to look tat the results from last 30 minutes. When i am using this wildcard, it does not give me any result. Replacing 'Wildcard' with 'match' worked though . like "match" :"Rajesh" or "match" :"Shiv". Is there something wrong with usage of wildcard in my query ?

Can you show a sample document that should match as well as your index mappings and settings? — Val
@sweta were u able to solve the issue or figure out the mapping? — user156327
Thanks for asking @OpsterElasticsearchNinja. No was not able to solve it using wildcard. But i have used 'match' for all the various combinations i would get in name field — swetha
@swetha thats good, could you please upvote and accept the answer as I mentioned about the match query as well in answer and it would be more valuable for the users to know when they see the closed(accepted and upvoted) answer. — user156327

user156327 user156327 · Accepted Answer · 2020-07-28T08:35:57

Most probably cause of the error is that you are using text field to store the names like Rajeash and Shiv and text fields by default uses the standard analyzer which lowercase the generated tokens so tokens would be creates as rajesh and shiv. Note the lowercase in the tokens.

When you use the match query, it uses the same analyzer so again it search with lowercase tokens and you get the result while wildcard query you are specifying the capital letter which doesn't matches the tokens in index.

change your wildcard query to *rajesh* and *shiv* and it should work, otherwise provide the mapping to further debug the issue.

How to use wildcard in elastic query?

1 Answers