How to use "wildcard" with a multistring query in kibana?

Question

I am trying to run the following query:

{"wildcard:"{"terminalId":70}} AND tranSactionResponseCode:1

The above query throws and error: Failed to parse query.......

but when I run the above query as: {"wildcard:"{"terminalId":70}} or when I run only the AND condition: tranSactionResponseCode:1 it runs successfully. Please help me in figuring out how do I use both the conditions in one single query.

Answer 1

I am assuming that your terminalId is of type text.

You can try the below two queries depending on your use. First one you can only make use of the bool query.

GET mytestindex/_search
{
  "query": { 
    "bool": { 
      "must": [
        { "wildcard": { "terminalId":   "70*"        }}, 
        { "match": { "tranSactionResponseCode": "1" }}  
      ]
    }
  }
}

Second, from my understanding it appears that you would want to filter documents based on transaction code. In that case as well as for better query performance you can make use of the below query which is using bool and filter. Note that I have made use of wildcard as query context here.

GET mytestindex/_search
{
  "query": { 
    "bool": { 
      "must": [
        { "wildcard": { "terminalId":   "70*" }       
        } 
      ],
      "filter": [ 
        { "term":  { "tranSactionResponseCode": "2" }}
      ]
    }
  }
}

Do check the score when you execute both the queries. The second option won't take into consideration tranSactionResponseCode to calculate its score.

Hope it helps!