How to handle wildcards in elastic search structured queries

Question

My use case requires to query for our elastic search domain with trailing wildcards. I wanted to get your opinion on the best practices of handling such wildcards in the queries

Answer 1

If you have the possibility of changing your mapping type and index settings, the right way to go is to create a custom analyzer with an edge-n-gram token filter that would index all prefixes of the attribute field.

curl -XPUT http://localhost:9200/your_index -d '{
    "settings": {
        "analysis": {
            "filter": {
                "edge_filter": {
                    "type": "edgeNGram",
                    "min_gram": 1,
                    "max_gram": 15
                }
            },
            "analyzer": {
                "attr_analyzer": {
                    "type": "custom",
                    "tokenizer": "standard",
                    "filter": ["lowercase", "edge_filter"]
                }
            }
        }
    },
    "mappings": {
        "your_type": {
            "properties": {
                "attribute": {
                    "type": "string",
                    "analyzer": "attr_analyzer",
                    "search_analyzer": "standard"
                }
            }
        }
    }
}'

Then, when you index a document, the attribute field value (e.g.) postfixing will be indexed as the following tokens: p, po, pos, post, postf, postfi, postfix, postfixi, postfixin, postfixing.

Finally, you can then easily query the attribute field for the postfix value using a simple match query like this. No need to use an under-performing wildcard in a query string query.

{
  "query": {
     "match" : {
        "attribute" : "postfix"
     }
  }
}