Error while using wildcard in multifield query_string query

[eliaslevy]

I've indexed some data with a field named "observed" that is an object with two other fields named "filename" and "pathname". These fields are analyzed and have multiple values.

The following query executed without problems:

"query_string" : { 
  "fields" : ["observed.filename", "observed.pathname"], 
  "query" : "Autorun", 
  "use_dis_max" : true 
}

but when I change it to the following it fails:

"query_string" : {
  "fields" : ["observed.*"],
  "query" : "Autorun",
  "use_dis_max" : true
}

with the error:

"SearchPhaseExecutionException[Failed to execute phase [query], total failure; shardFailures {[jHW46VKNS_G6Cnrdzko_WA][file_analysis][0]: SearchParseException[[file_analysis][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\t"query": {\t "query_string" : {\t "fields" : ["observed."],\t "query" : "Autorun",\t "use_dis_max" : true\t }\t}}]]]; nested: NumberFormatException[For input string: "Autorun"]; }{[jHW46VKNS_G6Cnrdzko_WA][file_analysis][1]: SearchParseException[[file_analysis][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\t"query": {\t "query_string" : {\t "fields" : ["observed."],\t "query" : "Autorun",\t "use_dis_max" : true\t }\t}}]]]; nested: NumberFormatException[For input string: "Autorun"]; }]

Why is that? The docs indicate it should work.

Also odd is that the following works:

"query_string" : {
  "fields" : ["observed.f*"],
  "query" : "Autorun",
  "use_dis_max" : true
}

but this fails:

"query_string" : {
  "fields" : ["observed.p*"],
  "query" : "Autorun",
  "use_dis_max" : true
}

I am Running 0.90.0. The mapping for the fields looks like:

"observed" : {
  "type": "object",
  "properties" : {
    "pathname"  : { "type": "string", "analyzer": "path"              },
    "filename"  : {
      "type": "multi_field",
      "fields": {
        "filename": { "type": "string", "analyzer": "path"              },
        "whole"   : { "type": "string", "analyzer": "lowercase_keyword" }
      }
    }
  }
}

There are some other fields in there as well.

[mattweber]

This is not a wildcard issue, it is due to attempting to search a field with the wrong format. You must have a numeric field that begins with a p inside of the observed object. When using your wildcard, this field get's included in the searchable fields and thus throws and error when you attempt to search it using a query string. Set the lenient parameter to true to ignore these types of errors as documented here: http://www.elasticsearch.org/guide/reference/query-dsl/query-string-query/

[eliaslevy]

Doh. Makes sense. Thanks for pointing it out Matt. Closing.