This query function performs a wildcard pattern search with optional case insensitivity.

The primary purpose is to make it easier to do case insensitive searching across fields and events using a wildcard pattern instead of a regular expression. This is especially useful for users unfamiliar with regular expressions.

ParameterTypeRequiredDefaultDescription
fieldarray of stringsoptional  Determines which fields the pattern should search in. When no fields are given, all fields of the original, unmodified event will be searched.
ignoreCasebooleanoptionalfalse Allows for case-insensitive searching.
patternstringrequired  Wildcard (glob) pattern to search for.

Depending on the field and ignoreCase arguments, the wildcard() behavior can vary:

  • Whenever ignoreCase is true:

    • the search will be case-insensitive; for example, if the given pattern is *http* then this will match any upper/lower-case combination of HTTP.

    • the search is equivalent to a case-insensitive regex, either on the given fields, or as an unanchored freetext regex that searches the entire, original, unmodified event — see the example below Searching Fields Through a Given Pattern – Example 5.

  • Whenever ignoreCase is false, the search is equivalent to a wildcard-search, either on the given fields, or as an unanchored, freetext search on the entire, original, unmodified event.

To sum up:

Table: wildcard() behavior

  field is [] or not specified field is specified as [field1, field2, …, ]

ignoreCase = false

*<pattern>* field1=<pattern> OR field2=<pattern> OR …

ignoreCase = true

/<patternAsRegex>/i field1=/<patternAsRegex>/i OR field2=/<patternAsRegex>/i OR …(as unanchored regexes)

Note

For performance reasons, only set ignoreCase to true if necessary; the case-insensitive search might be up to 2x slower than having this parameter set to false — depending on the search pattern and the data.

The following query:

logscale
wildcard(field=myField, pattern="*foobar*")

can be written as:

logscale
myField =~ wildcard("*foobar*")

This is because pattern is the implicit parameter, and parameters named field can be used with the =~ shorthand syntax in general in the query language.

wildcard(...) can be negated by using not wildcard(...), this finds all events that did not match the given pattern.

wildcard() Examples

Finding Fields with Data in Class

Query
flowchart LR; repo{{Events}} 0[/Filter/] 1[/Filter/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result
logscale
wildcard(field=class,pattern="*Data*")

|groupBy(class)
Introduction

Find all events containing any Data string in their class, and count the occurrences for each class that is found. For example, it can be used to get a list of events that have items such as DataIngestRateMonitor, or LocalDatasource.

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0[/Filter/] 1[/Filter/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Search the incoming data to list all events having Data (and everything around it) in their string.

    logscale
    wildcard(field=class,pattern="*Data*")
  3. flowchart LR; repo{{Events}} 0[/Filter/] 1[/Filter/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;

    Take the events extracted from the search and group them by the class field.

    logscale
    |groupBy(class)

  4. Event Result set

Summary and Results

The result is an aggregated count of all events matching anything with Data (with one or more characters before or after), in the class field.

Searching Data with wildcard()

Figure 110. Searching Data with wildcard()


Finding Fields with S3Bucket in Class

Query
flowchart LR; repo{{Events}} 0[/Filter/] 1[/Filter/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result
logscale
wildcard(field=class, pattern="*S3Bucket*", ignoreCase=true)

|groupBy(class)
Introduction

Find all events containing any S3Bucket item (and all before and after) in their class, and count the occurrences for each class that is found.

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0[/Filter/] 1[/Filter/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Search the incoming data to list all events having S3Bucket (or everything around it, case-insensitive) in their string.

    logscale
    wildcard(field=class, pattern="*S3Bucket*", ignoreCase=true)
  3. flowchart LR; repo{{Events}} 0[/Filter/] 1[/Filter/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;

    Take the events extracted from the search and group them by the class field.

    logscale
    |groupBy(class)

  4. Event Result set

Summary and Results

The result is an aggregated count of all events matching anything with S3Bucket , case-insensitive, in the class field.

Searching S3Bucket with wildcard()

Figure 111. Searching S3Bucket with wildcard()


Searching Fields Through a Given Pattern – Example 1

Query
flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result
logscale
wildcard(field=animal, pattern=horse, ignoreCase=false)
Introduction

Given the following events:

no-highlight
|--------------|------------------------|
| animal       | horse                  |
| animal       | Horse                  |
| animal       | duck                   |
| animal       | HORSES                 |
| animal       | crazy hOrSe            |
| animal       | hooorse                |
| animal       | dancing with horses    |
|--------------|------------------------|

Find events where the field animal contains the exact value horse , and make it case-sensitive.

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Search elements in the field animal that match horse.

    logscale
    wildcard(field=animal, pattern=horse, ignoreCase=false)

  3. Event Result set

Summary and Results

The result is a list of events matching exactly the given pattern horse .

The query used is equivalent to animal="horse" .

Searching Fields Through a Given Pattern – Example 2

Query
flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result
logscale
wildcard(field=animal, pattern=horse, ignoreCase=true)
Introduction

Given the following events:

no-highlight
|--------------|------------------------|
| animal       | horse                  |
| animal       | Horse                  |
| animal       | duck                   |
| animal       | HORSES                 |
| animal       | crazy hOrSe            |
| animal       | hooorse                |
| animal       | dancing with horses    |
|--------------|------------------------|

Find events where the field animal contains the value horse , and make it case-insensitive.

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Search elements in the field animal that match horse, case-insensitive.

    logscale
    wildcard(field=animal, pattern=horse, ignoreCase=true)

  3. Event Result set

Summary and Results

The result is a list of events matching either horse or Horse .

The query used is equivalent to animal=/\Ahorse\z/i.

Note that it is anchored.

Searching Fields Through a Given Pattern – Example 3

Query
flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result
logscale
wildcard(field=animal, pattern=*h*rse*, ignoreCase=true)
Introduction

Given the following events:

no-highlight
|--------------|------------------------|
| animal       | horse                  |
| animal       | Horse                  |
| animal       | duck                   |
| animal       | HORSES                 |
| animal       | crazy hOrSe            |
| animal       | hooorse                |
| animal       | dancing with horses    |
|--------------|------------------------|

Find events where field animal matches the given pattern, and it's case-insensitive:

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Search elements in the field animal that match *h*rse*.

    logscale
    wildcard(field=animal, pattern=*h*rse*, ignoreCase=true)

  3. Event Result set

Summary and Results

The result is a list of the following accepted events:

  • horse

  • Horse

  • HORSES

  • crazy hOrSe

  • dancing with horses

  • hooorse

The query used is equivalent to: animal=/h.*rse/i .

Note that it is unanchored.

Searching Fields Through a Given Pattern – Example 4

Query
flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result
logscale
wildcard(pattern=horse, ignoreCase=false)
Introduction

Given the following events:

no-highlight
|--------------|------------------------|
| animal       | horse                  |
| animal       | Horse                  |
| animal       | duck                   |
| animal       | HORSES                 |
| animal       | crazy hOrSe            |
| animal       | hooorse                |
| animal       | dancing with horses    |
|--------------|------------------------|

Find events that contain horse , case-sensitive:

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Search elements in the field animal that match anything with horse.

    logscale
    wildcard(pattern=horse, ignoreCase=false)

  3. Event Result set

Summary and Results

The result accepts the events horse and dancing with horses . This query is equivalent to the freetext search "horse" .

Searching Fields Through a Given Pattern – Example 5

Query
flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result
logscale
wildcard(pattern=horse, ignoreCase=true)
Introduction

Given the following events:

no-highlight
|--------------|------------------------|
| animal       | horse                  |
| animal       | Horse                  |
| animal       | duck                   |
| animal       | HORSES                 |
| animal       | crazy hOrSe            |
| animal       | hooorse                |
| animal       | dancing with horses    |
|--------------|------------------------|

Find events that contain horse , case-insensitive:

Step-by-Step

  1. Starting with the source repository events

  2. flowchart LR; repo{{Events}} 0[/Filter/] result{{Result Set}} repo --> 0 0 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;

    Search elements in the field animal that match anything with horse, case-insensitive.

    logscale
    wildcard(pattern=horse, ignoreCase=true)

  3. Event Result set

Summary and Results

The result is a list of the following accepted events:

  • horse

  • Horse

  • HORSES

  • crazy hOrSe

  • dancing with horses .

This query is equivalent to the freetext regex /horse/i .