Can only use wildcard queries on keyword text and wildcard fields – not on – How to solve this Elasticsearch exception

Briefly, this error occurs when a wildcard query is used on a field that is not of type keyword, text, or wildcard in Elasticsearch. Elasticsearch only supports wildcard queries on these types of fields. To resolve this issue, you can either change the field type to keyword, text, or wildcard, or use a different type of query that is supported by the current field type. Another solution is to create a multi-field with a keyword type and use the wildcard query on this new field.

Before you dig into reading this guide, have you tried asking OpsGPT what this log means? You’ll receive a customized analysis of your log.

Try OpsGPT now for step-by-step guidance and tailored insights into your Elasticsearch/OpenSearch operation.

To understand why Elasticsearch can only use wilcard queries on keyword, text and wildcard fields, we recommend you run the AutoOps for Elasticsearch which can help you resolve this issue./p>

This guide will explain how to resolve the log “Can only use wildcard queries on keyword; text and wildcard fields – not on” to appear. It’s also important to understand the basic related issues, so below there is a general overview on indices in Elasticsearch.

Overview

With a wildcard query you can query for documents that match a given wildcard pattern. The query supports the following wildcard operators:

• ?: matches any single character
• *: can match zero or more characters, including an empty one

You can also parameterize the query to be case sensitive/insensitive (by default it’s case insensitive).

If you want to see the wildcard query in practice, follow the steps below to quickly build a scenario to experiment with.

First, let’s create an index about fruits. This index only maps a text field: the fruit name.

PUT fruits
{
  "mappings": {
    "properties": {
      "name": {
        "type": "text"
      }
    }
  }
}

Now let’s bulk index some documents representing some fruits:

POST _bulk
{ "index" : { "_index" : "fruits"} }
{ "name" : "Apple" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Banana" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Blackberry" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Lemon" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Lime" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Melon" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Pineapple" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Raspberry" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Strawberry" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Watermelon" }

Consider the following query template for querying our fruits index:

POST fruits/_search
{
  "query": {
    "wildcard": {
      "name": {
        "value": "<wildcard pattern>"
      }
    }
  }
}

Now, replace the wildcard pattern with the examples below and you should get similar results:

• “*melon”: Melon, Watermelon
• “l?m*”: Lemon, Lime
• “*apple”: Apple, Pineapple
• “*berry”: Blackberry, Raspberry, Strawberry

Why it occurs

If you’re getting this error it probably means you’re trying to execute a wildcard query in a field that is not mapped as keyword, text or wildcard.

For instance, you could be trying to run the wildcard query against a numeric field. Say you wanted to find employees that are thirty-something years old:

POST employees/_search
{
  "query": {
    "wildcard": {
      "age": {
        "value": "3?"
      }
    }
  }
}

This will not work if the age field is mapped as a numeric data type and will actually fail with the “Can only use wildcard queries on keyword, text and wildcard fields – not on [age] which is of type [integer]” error message appearing.

How to resolve it

If you plan to run wildcard queries against a specific field of your index, make sure it is mapped either with keyword, text or with the wildcard type. One thing you could consider is to map the field both as number and text, using the multi-fields mapping feature and then run the wildcard query against the text sub-field:

PUT employees
{
  "mappings": {
    "properties": {
      "age": {
        "type": "integer",
        "fields": {
          "as_text": { 
            "type": "keyword"
          }
        }
      }
    }
  }
}
 
POST employees/_doc
{
  "age": 30
}
 
POST employees/_search
{
  "query": {
    "wildcard": {
      "age.as_text": {
        "value": "3?"
      }
    }
  }
}

* The example above serves merely to show an hypothetical scenario that would cause the “Can only use wildcard queries on keyword, text and wildcard fields” error to occur. If you need to query a numeric field for an interval of values you’d be much more well served with the range query.