Can only use wildcard queries on keyword; text and wildcard fields – not on – How to solve this Elasticsearch error

Average Read Time

3 Mins

Can only use wildcard queries on keyword; text and wildcard fields – not on – How to solve this Elasticsearch error

Opster Team

February-21, Version: 1.7-8.0

To understand why Elasticsearch can only use wilcard queries on keyword, text and wildcard fields, we recommend you run the Elasticsearch Error Check-Up which can help you resolve this issue. It’s a free tool that requires no installation and analyzes your cluster on the spot.

This guide will explain how to resolve the log “Can only use wildcard queries on keyword; text and wildcard fields – not on” to appear. It’s also important to understand the basic related issues, so below there is a general overview on indices in Elasticsearch.

Overview

With a wildcard query you can query for documents that match a given wildcard pattern. The query supports the following wildcard operators:

  • ?: matches any single character
  • *: can match zero or more characters, including an empty one

You can also parameterize the query to be case sensitive/insensitive (by default it’s case insensitive).

If you want to see the wildcard query in practice, follow the steps below to quickly build a scenario to experiment with.

First, let’s create an index about fruits. This index only maps a text field: the fruit name.

PUT fruits
{
  "mappings": {
    "properties": {
      "name": {
        "type": "text"
      }
    }
  }
}

Now let’s bulk index some documents representing some fruits:

POST _bulk
{ "index" : { "_index" : "fruits"} }
{ "name" : "Apple" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Banana" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Blackberry" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Lemon" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Lime" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Melon" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Pineapple" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Raspberry" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Strawberry" }
{ "index" : { "_index" : "fruits"} }
{ "name" : "Watermelon" }

Consider the following query template for querying our fruits index:

POST fruits/_search
{
  "query": {
    "wildcard": {
      "name": {
        "value": ""
      }
    }
  }
}

Now, replace the wildcard pattern with the examples below and you should get similar results:

  • “*melon”: Melon, Watermelon
  • “l?m*”: Lemon, Lime
  • “*apple”: Apple, Pineapple
  • “*berry”: Blackberry, Raspberry, Strawberry

Why it occurs

If you’re getting this error it probably means you’re trying to execute a wildcard query in a field that is not mapped as keyword, text or wildcard.

For instance, you could be trying to run the wildcard query against a numeric field. Say you wanted to find employees that are thirty-something years old:

POST employees/_search
{
  "query": {
    "wildcard": {
      "age": {
        "value": "3?"
      }
    }
  }
}

This will not work if the age field is mapped as a numeric data type and will actually fail with the “Can only use wildcard queries on keyword, text and wildcard fields – not on [age] which is of type [integer]” error message appearing.

How to resolve it

If you plan to run wildcard queries against a specific field of your index, make sure it is mapped either with keyword, text or with the wildcard type. One thing you could consider is to map the field both as number and text, using the multi-fields mapping feature and then run the wildcard query against the text sub-field:

PUT employees
{
  "mappings": {
    "properties": {
      "age": {
        "type": "integer",
        "fields": {
          "as_text": { 
            "type": "keyword"
          }
        }
      }
    }
  }
}
 
POST employees/_doc
{
  "age": 30
}
 
POST employees/_search
{
  "query": {
    "wildcard": {
      "age.as_text": {
        "value": "3?"
      }
    }
  }
}

* The example above serves merely to show an hypothetical scenario that would cause the “Can only use wildcard queries on keyword, text and wildcard fields” error to occur. If you need to query a numeric field for an interval of values you’d be much more well served with the range query.

Log Context

Log “Can only use wildcard queries on keyword; text and wildcard fields – not on [“classname  is MappedFieldType.java We extracted the following from Elasticsearch source code for those seeking an in-depth context :

} 
 public Query wildcardQuery(String value;
 @Nullable MultiTermQuery.RewriteMethod method;
 QueryShardContext context) {
 throw new QueryShardException(context; "Can only use wildcard queries on keyword; text and wildcard fields - not on [" + name
 + "] which is of type [" + typeName() + "]");
 } 
 public Query regexpQuery(String value; int flags; int maxDeterminizedStates; @Nullable MultiTermQuery.RewriteMethod method;
 QueryShardContext context) {

 

Watch a demo of the Check-Up:

Overview

In Elasticsearch, an index (plural: indices) contains a schema and can have one or more shards and replicas. An Elasticsearch index is divided into shards and each shard is an instance of a Lucene index.

Indices are used to store the documents in dedicated data structures corresponding to the data type of fields. For example, text fields are stored inside an inverted index whereas numeric and geo fields are stored inside BKD trees.

Examples

Create index

The following example is based on Elasticsearch version 5.x onwards. An index with two shards, each having one replica will be created with the name test_index1

PUT /test_index1?pretty
{
    "settings" : {
        "number_of_shards" : 2,
        "number_of_replicas" : 1
    },
    "mappings" : {
        "properties" : {
            "tags" : { "type" : "keyword" },
            "updated_at" : { "type" : "date" }
        }
    }
}

List indices

All the index names and their basic information can be retrieved using the following command:

GET _cat/indices?v

Index a document

Let’s add a document in the index with the command below:

PUT test_index1/_doc/1
{
  "tags": [
    "opster",
    "elasticsearch"
  ],
  "date": "01-01-2020"
}

Query an index

GET test_index1/_search
{
  "query": {
    "match_all": {}
  }
}

Query multiple indices

It is possible to search multiple indices with a single request. If it is a raw HTTP request, index names should be sent in comma-separated format, as shown in the example below, and in the case of a query via a programming language client such as python or Java, index names are to be sent in a list format.

GET test_index1,test_index2/_search

Delete indices

DELETE test_index1

Common problems

  • It is good practice to define the settings and mapping of an Index wherever possible because if this is not done, Elasticsearch tries to automatically guess the data type of fields at the time of indexing. This automatic process may have disadvantages, such as mapping conflicts, duplicate data and incorrect data types being set in the index. If the fields are not known in advance, it’s better to use dynamic index templates.
  • Elasticsearch supports wildcard patterns in Index names, which sometimes aids with querying multiple indices, but can also be very destructive too. For example, It is possible to delete all the indices in a single command using the following commands:
DELETE /*

To disable this, you can add the following lines in the elasticsearch.yml:

action.destructive_requires_name: true

Log Context

Log “Can only use wildcard queries on keyword; text and wildcard fields – not on [“classname  is MappedFieldType.java We extracted the following from Elasticsearch source code for those seeking an in-depth context :

} 
 public Query wildcardQuery(String value;
 @Nullable MultiTermQuery.RewriteMethod method;
 QueryShardContext context) {
 throw new QueryShardException(context; "Can only use wildcard queries on keyword; text and wildcard fields - not on [" + name
 + "] which is of type [" + typeName() + "]");
 } 
 public Query regexpQuery(String value; int flags; int maxDeterminizedStates; @Nullable MultiTermQuery.RewriteMethod method;
 QueryShardContext context) {

 

Watch a demo of the Check-Up:

Analyze your cluster