Wildcard query fails on _index

[varunsharma27]

Kibana Version: 5.4.3
Elasticsearch Version: 5.4.3
OS: Ubuntu 16.10, Windows 7

While queries on fields such as _type works just fine :-

GET /_search
{
"query": {
"wildcard" : { "_type" : "inde*" }
}
}

But when i run code even as simple as :-

GET /_search
{
"query": {
"wildcard" : { "_index" : ".kib*" }
}
}

I get greeted by an error message like this :-

{
"error": {
"root_cause": [
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "XF4sz8QzSH-4IULAikLaQg",
"index": ".kibana"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "T53UWmqYR6aOB_wYbZnyAA",
"index": "auto"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "n5J6B9wLQSu-P6Ea8Gzfcw",
"index": "elk"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "bXirSfCpTBuH0J_kX3SjZw",
"index": "index"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "K1fQCwsEQGyllfAWh5gtsQ",
"index": "library"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "3VoVe4UhRLOntuWH0ury6Q",
"index": "person"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "XZWOWIL9TzWyQTOpUXySeA",
"index": "try_index"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "w3AD2R6BSbCLkLpY_biTBw",
"index": "tryindex"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "puvR3VIGR1aIrA38KsL8ww",
"index": "vartoken"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "qTktBjOST7KAKk4zuEYo_A",
"index": "varun"
},
{
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "M0OnUiw5RS-lOCJ-kHt6_A",
"index": "varun_nocrid"
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": ".kibana",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "XF4sz8QzSH-4IULAikLaQg",
"index": ".kibana",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: .kibana vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "auto",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "T53UWmqYR6aOB_wYbZnyAA",
"index": "auto",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: auto vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "elk",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "n5J6B9wLQSu-P6Ea8Gzfcw",
"index": "elk",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: elk vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "index",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "bXirSfCpTBuH0J_kX3SjZw",
"index": "index",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: index vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "library",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "K1fQCwsEQGyllfAWh5gtsQ",
"index": "library",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: library vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "person",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "3VoVe4UhRLOntuWH0ury6Q",
"index": "person",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: person vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "try_index",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "XZWOWIL9TzWyQTOpUXySeA",
"index": "try_index",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: try_index vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "tryindex",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "w3AD2R6BSbCLkLpY_biTBw",
"index": "tryindex",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: tryindex vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "vartoken",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "puvR3VIGR1aIrA38KsL8ww",
"index": "vartoken",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: vartoken vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "varun",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "qTktBjOST7KAKk4zuEYo_A",
"index": "varun",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: varun vs. .kib*"]"
}
}
},
{
"shard": 0,
"index": "varun_nocrid",
"node": "vT0v2wjETTeP8qXqlK7eyw",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: {\n "wildcard" : {\n "_index" : {\n "wildcard" : ".kib*",\n "boost" : 1.0\n }\n }\n}",
"index_uuid": "M0OnUiw5RS-lOCJ-kHt6_A",
"index": "varun_nocrid",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Cannot extract a term from a query of type class org.elasticsearch.common.lucene.search.MatchNoDocsQuery: MatchNoDocsQuery["Index didn't match. Index queried: varun_nocrid vs. .kib*"]"
}
}
}
]
},
"status": 400
}

[colings86]

@varundbest I have reproduced what you see on master, however I have marked this as discuss to get some other's opinions because I'm not sure if the _index field is actually intended to work with the wildcard query.

The reason this fails is because IndexFieldMapper returns either a MatchAllDocsQuery or a MatchNoDocsQuery depending on whether the index name matches the value provided. The WildcardQueryBuilder then calls MappedFieldType.extractTerm() with this query and this method is not able to deal with queries that are not term based.

Just out of curiosity, why are you wanting to do a wildcard query on the _index field instead of just using a wildcard expression for the indices in the URL for the search? e.g.

GET .kib*/_search

[varunsharma27]

@colings86 Actually i'm implementing a user role-based access to dashboards and data. So the plan is to have a hidden filter which is based on the group the user belongs to. Ex:-
Group A:-
Have access to indices :- producta*, sales,etc. or they can access anything but productb*.
So to automatically limit the super-set of the dashboard data, based on the payload (usergroup) on jwt token.
So for white-listing, i can use the wildcard expression for indices but for blacklisting, i'd actually require something like a wildcard query.

[jpountz]

Discussed in FixitFriday. We agreed on supporting that feature, eagerly evaluating the wildcard against the index name and returning a match_all/match_none depending on whether there is a match.