Elasticsearch wildcard search string not_analyzed
<p>I am having problem with wildcard search on field that is not_analyzed string.</p>

<p>I am using td-agent (plugin-elasticsearch) -> elasticsearch (kibana). I tried setting mapping to not_analyzed because my field "tag" contains dots. Example of entry:</p>

<pre><code>{
  "_index": "logstash-2016.06.27",
  "_type": "fluentd",
  "_id": "AVWRR1tIYMKfwXgMeyTA",
  "_score": null,
  "_source": {
    "app": "RECEIVER",
    "thread": "139639914489600",
    "severity": "INFO ",
    "message": "FM version 0",
    "tag": "beeeon.ant-2.ada_server",
    "@timestamp": "2016-06-27T11:53:35+02:00"
  },
  "fields": {
    "@timestamp": [
      1467021215000
    ]
  },
  "sort": [
    1467021215000
  ]
}
</code></pre>

<p>This current mapping of the document:</p>

<pre><code>{
  "simple-template" : {
    "order" : 0,
    "template" : "logstash-*",
    "settings" : {
      "index" : {
        "number_of_shards" : "1",
        "number_of_replicas" : "1"
      }
    },
    "mappings" : {
      "_default_" : {
        "properties" : {
          "app" : {
            "index" : "analyzed",
            "type" : "string"
          },
          "severity" : {
            "index" : "analyzed",
            "type" : "string"
          },
          "@timestamp" : {
            "index" : "not_analyzed",
            "type" : "date"
          },
          "thread" : {
            "index" : "analyzed",
            "type" : "string"
          },
          "tag" : {
            "index" : "not_analyzed",
            "type" : "string"
          },
          "message" : {
            "index" : "not_analyzed",
            "type" : "string"
          }
        }
      }
    },
    "aliases" : { }
  }
}
</code></pre>

<p>Note the field "tag", having values such as "beeeon.ant-2.ada_server" or "beeeon.iotdata.ada_server".</p>

<p>Searching for tag with query such as 'tag:"beeeon.ant-2.ada_server"' or 'tag:"beeeon.iotdata.ada_server"' everything works correctly and i see different entries from that source, problem arises when i try to perform wildcards search such as '*' or 'tag:"beeeon.*.ada_server"'. I expect to see entries from both hosts, though i see entries only from last one.</p>

<p>Thanks for any advice </p>