Elasticsearch query_string wildcard syntax

Question

Apparently I can query ES with the following wildcard query_string:

curl 'http://localhost:9200/my-index/_search?pretty' -d '{
  "query": {
    "query_string": {
      "query": "*:sw?ft"
    }
  }
}'

Does this query against _all field ? which makes it equivalent to:

curl 'http://localhost:9200/my-index/_search?pretty' -d '{
  "query": {
    "query_string": {
      "default_field" : "_all"
      "query": "sw?ft"
    }
  }
}'

what if _all is disabled in indexing? I couldn't find the documentation for it.

Thanks in advance.

Andrei Stefan · Accepted Answer · 2015-10-28 00:39:12Z

2

A query_string with the searching command set to *:sw?ft will be transformed to something like the following (assuming your my-index index has a single my_field field, for example):

(_field_names:sw?ft | _all:sw?ft | _index:sw?ft | _parent:sw?ft | _uid:sw?ft | _type:sw?ft | _routing:sw?ft | _version:sw?ft | _timestamp:sw?ft | _source:sw?ft | _size:sw?ft | my_field:sw?ft | _id:sw?ft | _ttl:sw?ft | _boost:sw?ft)

So, the wildcard before : will be expanded to all the fields in the index, not only your own defined fields. Be very careful with wildcards in query_string, they can affect in a bad way the performance of the cluster.

So, to answer your question, * will be expanded to all the fields of the index, including _all. If you would have used just sw?ft as searching string then this, by default, would have been used _all.

answered Oct 28, 2015 at 0:39

Andrei Stefan

52.5k6 gold badges102 silver badges92 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

fast tooth Over a year ago

Thank you for this fantastic answer! I wonder where do you find all these details?

Andrei Stefan Over a year ago

These details can be found using the validate API ;-). It's really useful, especially with query_string.

fast tooth Over a year ago

ahaa! it will become my new friend. Thanks.

Evaldas Buinauskas · Accepted Answer · 2015-10-27 20:31:17Z

0

First of all, that's documentation for query_string query:

https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html

And it has answers to both of your questions:

When not explicitly specifying the field to search on in the query string syntax, the index.query.default_field will be used to derive which field to search on. It defaults to _all field.

So, if _all field is disabled, it might make sense to change it to set a different default field.

answered Oct 27, 2015 at 20:31

Evaldas Buinauskas

14.2k11 gold badges63 silver badges119 bronze badges

1 Comment

fast tooth Over a year ago

I am confused about the syntax of "*:sw?ft", I know i can use an individual field in place of the star, but does the star searches _all or each indexed field? If the star searches _all, AFAIK, _all is not lowercase, but query_string wildcard is, so it doesn't seems to make sense. Thank you for your reply.

Collectives™ on Stack Overflow

Elasticsearch query_string wildcard syntax

2 Answers 2

3 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related