I'm running the following opensearch query.
Sometimes I filter on a certain pname, sometimes I want to get all data for all pnames (i.e. no filter)
Rather than define two queries, one with the terms filter and one without it, I would like to have one query.
I thought I could pass in a ["*"] for this, but that doesn't seem to work. All my pname's have a prefix as well p- so I also thought I could pass in ["p-*"] but that also didn't work unfortunately.
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "%s",
"lte": "%s",
"format": "yyyy-MM-dd"
}
}
},
{
"terms": {
"pname.keyword": ["<wildcard to get all pnames?>"]
}
}
]
}
},
you need to use a wildcard query. for e.g.
}