Wildcard on key in graylog

Question

Hi I am trying to use wildcard on key inside of my query. Because I have arrays in my data so I am saving my data in flat form. Like obj_0_id, obj_1_ID and so on. So is there any way to write something like this obj_*_ID:123 Thank you

Answer 1

You can use query_string which lets you specify wildcards on field names. Example from docs:

{
    "query_string" : {
        "fields" : ["city.*"],
        "query" : "this AND that OR thus",
        "use_dis_max" : true
    }
}