27

I am trying to filter the documents using terms filter. I am not sure how to introduce wildcards in filter. I tried something like this:

"filter":{
  "bool":{
       "must":{
          "terms":{
             "wildcard" :  {
                "aircraft":[
                   "a380*"
                ]
             }
         }
      }
   }
}

But I get SearchParseException with this. Is there no way to use wildcard within filter framework?

Nikhil Sahu
  • 2,463
  • 2
  • 32
  • 48
Mohitt
  • 2,957
  • 3
  • 29
  • 52

1 Answers1

43

The terms filter doesn't support wildcards, queries do, though. Try this query instead

{
  "query": {
    "bool": {
      "must": {
        "wildcard": {
          "aircraft": "a380*"
        }
      }
    }
  }
}

Or if you absolutely need to use filters, you can try the regexp filter, too:

{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": {
            "regexp": {
              "aircraft": "a380.*"
            }
          }
        }
      }
    }
  }
}

UPDATE:

In latest ES versions, use the following query instead since filtered has been removed:

{
  "query": {
    "bool": {
      "filter": {
         "regexp": {
           "aircraft": "a380.*"
         }
      }
    }
  }
}
Val
  • 207,596
  • 13
  • 358
  • 360
  • 2
    `regexp` is a filter on its own, different from the `terms` filter. – Val May 27 '15 at 05:18
  • queries are exceptionally slower than filters. I guess instead of terms, I should go for multiple regexp under one 'should' block. – Mohitt May 27 '15 at 05:26
  • 2
    Queries and filters serve different purposes, the main goal of filters is to reduce the number of documents that have to be examined by the query. If your main use case is around searching text, queries are the way to go, but make sure to filter as much as you can so that queries run on as few documents as possible. – Val May 27 '15 at 05:29
  • Yes. I understand that. Actually my application is not meant for text analytics. Its using almost structured tabular data. I am doing a sort of benchmarking of elastic with splunk. – Mohitt May 27 '15 at 05:45
  • Gotcha. Comparing ES vs Splunk you'll get a big diff in the price tag ;-) – Val May 27 '15 at 05:53
  • Preliminary results show Elastic to be promising on the execution time point of view, but lacks well-packaged commands. Even though, I hope Elastic to win :P – Mohitt May 27 '15 at 06:33
  • 1
    Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/78876/discussion-between-mohitt-and-val). – Mohitt May 27 '15 at 09:50
  • Note that filtered has been removed since 5.0 (see https://stackoverflow.com/a/40521602/4244096 for the new version) – 91378246 Jun 03 '20 at 07:09