0

Below is a query that should be returning all the information on the entire named user called ‘mike’ for the current date. (As you can see I am using a wildcard to bring make all users called mike and any name after mike which is want I want.)

So data is being returned for the current date which is good however, the wildcard is not working and it’s bringing back data for all users not just mike.

Could someone help me I really need the wildcard to work.

My code:

GET_search
    {
      "_source": [
        "N"
      ],
      "query": {
        "bool": {
          "should": [
            {
              "wildcard": {
                "N": "mike*"
              }
            }
          ],
          "must": [
            {
              "range": {
                "VT": {
                  "gte": "now/d",
                  "lte": "now+1d/d"
                }
              }
            }
          ]
        }
      }
    }

1 Answer 1

1

Your problem is not the wildcard query, but the fact that it's in a should list. In the bool query docs, it says:

If the bool query is in a query context and has a must or filter clause then a document will match the bool query even if none of the should queries match.

That is your situation. You can solve this simply by moving the wildcard query to the must list, like this:

{
  "_source": [
    "N"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "VT": {
              "gte": "now/d",
              "lte": "now+1d/d"
            }
          }
        },
        {
          "wildcard": {
            "N": "mike*"
          }
        }
      ]
    }
  }
}

It would also work to keep the should and add a minimum_should_match of 1, but I can't think of any good reason to do that.

Sign up to request clarification or add additional context in comments.

3 Comments

thank you for explaining and your code is working for me! thank you so much. i wanted to ask if there is a way to filter on a time E.G right now its bringing back all the data today which is good but is there a way to only bring data between 11am and 2pm for today only?
i also upvoted and ticked your answer as the right one!
Yes -- you can use precise dates, like "2017-10-16T11:00" (format dependent on your mapping, but that's the default), or if you want relative, "now/d+11h". See the date math docs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.