Elasticsearch how to use multi_match with wildcard

Question

I have a User object with properties Name and Surname. I want to search these fields using one query, and I found multi_match in the documentation, but I don\'t

Answer 1

Alternatively you could use a query_string query with wildcards.

"query": {
    "query_string": {
        "query": "*mar*",
        "fields": ["user.name", "user.surname"]
    }
}

This will be slower than using an nGram filter at index-time (see my other answer), but if you are looking for a quick and dirty solution...

Also I am not sure about your mapping, but if you are using user.name instead of name your mapping needs to look like this:

"your_type_name_here": {
    "properties": {
        "user": {
            "type": "object",
            "properties": {
                "name": {
                    "type": "string"
                },
                "surname": {
                    "type": "string"
                }
            }
        }
    }
}

Answer 2

Such a query worked for me:

{
  "query": {
    "filtered": {
      "query": {
        "match_all": {}
      },
      "filter": {
        "bool": {
          "should": [
            {"query": {"wildcard": {"user.name": {"value": "*mar*"}}}},
            {"query": {"wildcard": {"user.surname": {"value": "*mar*"}}}}
          ]
        }
      }
    }
  }
}

Similar to what you are doing, except that in my case there could be different masks for different fields.

Answer 3

Similar to suggestion above, but this is simple and worked for me:

{
"query": {
    "bool": {
        "must":
        [
            {
                "wildcard" : { "processname.keyword" : "*system*" }
            },
            {
                "wildcard" : { "username" : "*admin*" }
            },
            {
                "wildcard" : { "device_name" : "*10*" }
            }
        ]
    }
}
}

Answer 4

I would not use wildcards, it will not scale well. You are asking a lot of the search engine at query time. You can use the nGram filter, to do the processing at index-time not search time.

See this discussion on the nGram filter.

After indexing the name and surname correctly (change your mapping, there are examples in the above link) you can use multi-match but without wildcards and get the expected results.

Answer 5

I just did this now:

GET _search {
    "query": {
        "bool": {
            "must": [
                {
                    "range": {
                        "theDate": {
                            "gte": "2014-01-01",
                            "lte": "2014-12-31"
                        }
                    }
                },
                {
                    "match" : {
                        "Country": "USA"
                    }
                }
            ],
            "should": [
                {
                    "wildcard" : { "Id_A" : "0*" }
                },
                {
                    "wildcard" : { "Id_B" : "0*" }
                }
            ],"minimum_number_should_match": 1
        }
    }
}