Filter string/keywork fields also by contains

[fioddor]

Is your feature request related to a problem? Please describe.

Users are frustrated when they want to filter by a value they don't correctly or fully remember.

They have workarounds available, but they just expect this search mode to be available and I believe it would be fairly easy to provide.

On the other hand, since they can search the value and use it, I would totally understand if OpenSearch wants to keep the filter dialog clean.

Describe the solution you'd like

The filter definition dialog could offer (for string, keyword, maybe list of strings/keywords) a containsoption along the existing ones (is, is one of, etc).

Describe alternatives you've considered

• Using Discover and the search bar to find the exact value and then use is to filter it: This is what I currently recommend to my customers.
• Enabling the SQL plugin: Needs action by the admin and has other (usability, security) implications.
• The is option searches and loads the sought value dropdown with suggestions. It does so by running a startswith search. Maybe it could run a second round as contains (after startswith, and only if there's still room in the dropdown for more suggestions).

Additional context

[abbyhu2000]

@ahopp @dagneyb @wbeckler Should we add a contains feature to the filter windows?

[dagneyb]

@abbyhu2000 sounds reasonable to me. Whats the level of effort?

[LDrago27]

Supporting additional filter operators (for eg: StartsWith, endsWith and contains) for discover requires a mapping to use Prefix and Wildcard queries on OpenSearch. Wildcard and Prefix Search queries fall under the bucket of expensive queries. (Refer here for more details). These kind of queries can consume a lot of memory and lead to a decline in cluster performance. These kind of queries only work if the "search.allow_expensive_queries": true setting is set for OpenSearch.

Thus implementing these additional features will require us to respect OpenSearch allow_expensive_queries setting as well as can result in a decline in cluster performance.

cc @ashwin-pc @abbyhu2000