Remove the default search wildcard and check the behaviour in Elastic

[nicocti]

Prerequisites

• I read the Deployment and Setup section of the OpenCTI documentation as well as the Troubleshooting page and didn't find anything relevant to my problem.
• I went through old GitHub issues and couldn't find anything relevant
• I googled the issue and didn't find anything relevant

Description

Hello !

I'm wondering whether there is a reason for adding a trailing wildcard on the elasticsearch "query_string" generated by a search for the frontend search bar.

Because of it, exact matches end up with a much lower score than less relevant documents where the keyword is embedded within text.

In some cases, the exact match (for instance a country entity) won't even be returned by the query results.

From my tests, removing the trailing wildcard from the query string gives the same results overall.

Environment

1. OS (where OpenCTI server runs): Ubuntu 20.04
2. OpenCTI version: 5.3.7
3. OpenCTI client: frontend
4. Other environment details: dockerized

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Search for a single keyword
2. Catch the elasticsearch query
3. Remove the trailing wildcard in the ES query

[Jipegien]

There was some changes in 5.8 regarding the search result priorities. Can you check if it is ok for you @nicocti ?

[SamuelHassine]

This feature is considered as complete given all recent changes to search and filters.