CODEWITHSUNDEEP
elasticsearchwildcard
fast tooth
fast tooth

Reputation: 2459

Elasticsearch query_string wildcard syntax

Apparently I can query ES with the following wildcard query_string: 

curl 'http://localhost:9200/my-index/_search?pretty' -d '{
  "query": {
    "query_string": {
      "query": "*:sw?ft"
    }
  }
}'

Does this query against _all field ? which makes it equivalent to: 

curl 'http://localhost:9200/my-index/_search?pretty' -d '{
  "query": {
    "query_string": {
      "default_field" : "_all"
      "query": "sw?ft"
    }
  }
}'

what if _all is disabled in indexing? I couldn't find the documentation for it.

Thanks in advance.

Upvotes: 1

Views: 4731

Answers (2)

Andrei Stefan
Andrei Stefan

Reputation: 52368

A query_string with the searching command set to *:sw?ft will be transformed to something like the following (assuming your my-index index has a single my_field field, for example):

(_field_names:sw?ft | _all:sw?ft | _index:sw?ft | _parent:sw?ft | _uid:sw?ft | _type:sw?ft | _routing:sw?ft | _version:sw?ft | _timestamp:sw?ft | _source:sw?ft | _size:sw?ft | my_field:sw?ft | _id:sw?ft | _ttl:sw?ft | _boost:sw?ft)

So, the wildcard before : will be expanded to all the fields in the index, not only your own defined fields. Be very careful with wildcards in query_string, they can affect in a bad way the performance of the cluster.

So, to answer your question, * will be expanded to all the fields of the index, including _all. If you would have used just sw?ft as searching string then this, by default, would have been used _all.

Upvotes: 2

Evaldas Buinauskas
Evaldas Buinauskas

Reputation: 14077

First of all, that's documentation for query_string query:

And it has answers to both of your questions:

When not explicitly specifying the field to search on in the query string syntax, the index.query.default_field will be used to derive which field to search on. It defaults to _all field.

So, if _all field is disabled, it might make sense to change it to set a different default field.

Upvotes: 0

Related Questions