Wildcard and prefix queries in Elasticsearch - Step-by-Step Execution

Concept Flow - Wildcard and prefix queries

Start Query

↓

Check Query Type

↓

Prefix?

↓

Build prefix

↓

Search index with pattern

↓

Return matching documents

↓

End

The query starts by checking if it is a prefix or wildcard query, builds the pattern accordingly, searches the index, and returns matching documents.

Execution Sample

Elasticsearch

GET /my_index/_search
{
  "query": {
    "wildcard": { "user": "ki*y" }
  }
}

This query searches for documents where the 'user' field matches the pattern 'ki*y', where '*' matches any characters.

Execution Table

Step	Query Part	Action	Pattern Used	Result
1	Receive query	Parse JSON query	wildcard on user	Ready to process
2	Identify query type	Check if prefix or wildcard	wildcard	Proceed with wildcard logic
3	Build pattern	Use 'ki*y' as pattern	ki*y	Pattern ready
4	Search index	Match documents with user matching 'ki*y'	ki*y	Documents found: user='kitty', user='kiry'
5	Return results	Send matching documents back	N/A	2 documents returned
6	End	Query complete	N/A	Done

💡 Query ends after returning all documents matching the wildcard pattern.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
query_type	undefined	wildcard	wildcard	wildcard	wildcard
pattern	undefined	undefined	ki*y	ki*y	ki*y
matched_docs	empty	empty	empty	['kitty', 'kiry']	['kitty', 'kiry']

Key Moments - 2 Insights

Why does the wildcard query use '*' in 'ki*y'?

The '*' is a special character that matches any sequence of characters, so 'ki*y' matches any word starting with 'ki' and ending with 'y', like 'kitty' or 'kiry' as shown in step 4 of the execution_table.

How is a prefix query different from a wildcard query?

A prefix query only matches documents where the field starts with a given string, without wildcards inside. The execution_table shows the query type check at step 2, where prefix and wildcard queries are handled differently.

Visual Quiz - 3 Questions

Look at the execution_table, what is the pattern used at step 3?

A "*y"

B "ki"

C "ki*y"

D "k*y"

💡 Hint

Check the 'Pattern Used' column at step 3 in the execution_table.

At which step does the query identify it is a wildcard query?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'Query Part' and 'Action' columns in the execution_table for step 2.

If the query was a prefix query instead, how would the pattern change?

A It would use a pattern like "ki*" without other wildcards

B It would use the same pattern "ki*y"

C It would use a regex pattern

D It would not use any pattern

💡 Hint

Recall the difference between prefix and wildcard queries explained in key_moments and the concept_flow.

Concept Snapshot

Wildcard and prefix queries in Elasticsearch:
- Wildcard queries use '*' and '?' to match any characters.
- Prefix queries match documents starting with a given string.
- Wildcard queries can match anywhere in the string.
- Prefix queries are faster and simpler.
- Use wildcard for flexible matching, prefix for fixed starts.

Full Transcript

This visual execution trace shows how Elasticsearch processes wildcard and prefix queries. The query starts by parsing the JSON input, then identifies if it is a prefix or wildcard query. For a wildcard query like 'ki*y', it builds the pattern and searches the index for matching documents. The example finds documents with user fields like 'kitty' and 'kiry'. Variables like query_type, pattern, and matched_docs change step by step. Key moments clarify why '*' is used and how prefix queries differ. The quiz tests understanding of pattern usage and query type identification. The snapshot summarizes the main points for quick recall.

Practice

1. What does a wildcard query with * symbol do in Elasticsearch?

easy

A. Matches terms ending with a specific suffix

B. Matches only the exact search term

C. Matches terms starting with a specific prefix

D. Matches any sequence of characters in the search term

Solution

1. Step 1: Understand the wildcard symbol *

   The * symbol in wildcard queries matches zero or more characters in any position of the term.

2. Step 2: Compare with other options

   Exact match requires no wildcard, prefix queries use a different query type, and suffix matching is not directly done by * alone.

3. Final Answer:

   Matches any sequence of characters in the search term -> Option D

4. Quick Check:

   wildcard * = match any chars [OK]

Hint: Remember * matches any characters, ? matches one character [OK]

Common Mistakes:

• Confusing wildcard * with prefix query
• Thinking * matches only one character
• Assuming wildcard matches exact terms only

2. Which of the following is the correct syntax for a prefix query in Elasticsearch?

easy

A. { "prefix": { "field_name": "pre" } }

B. { "wildcard": { "field_name": "pre*" } }

C. { "match": { "field_name": "pre*" } }

D. { "term": { "field_name": "pre*" } }

Solution

1. Step 1: Identify prefix query syntax

   Prefix queries use the prefix keyword with the field and the prefix string.

2. Step 2: Check other options

   Wildcard queries use wildcard, match and term queries do not support prefix syntax with asterisk.

3. Final Answer:

   { "prefix": { "field_name": "pre" } } -> Option A

4. Quick Check:

   prefix query uses "prefix" keyword [OK]

Hint: Prefix queries use "prefix" keyword, not wildcard or match [OK]

Common Mistakes:

• Using wildcard syntax for prefix query
• Using match query with asterisk
• Confusing term query with prefix query

3. Given the following wildcard query, which documents will match?

{ "query": { "wildcard": { "name": "jo?n*" } } }

Assuming documents have names: "john", "joan", "jonas", "joanathan", "jo".

medium

A. ["joan", "jonas", "joanathan"]

B. ["john", "joan", "jo"]

C. ["john", "joan", "joanathan"]

D. ["john", "joan", "jonas", "joanathan", "jo"]

Solution

1. Step 1: Analyze the wildcard pattern "jo?n*"

   The pattern means: 'jo' followed by any single character (due to '?'), then 'n', then any characters (due to '*').

2. Step 2: Check each name against the pattern

   "john" matches ('h' replaces '?'), "joan" matches ('a' replaces '?'), "joanathan" matches ('a' replaces '?'). "jonas" does not match ('n' replaces '?' but next 'a' ≠ 'n'). "jo" is too short to match.

3. Final Answer:

   ["john", "joan", "joanathan"] -> Option C

4. Quick Check:

   wildcard ? = one char, * = any chars [OK]

Hint: ? matches one char, * matches zero or more chars [OK]

Common Mistakes:

• Assuming ? matches zero characters
• Including too short strings like "jo"
• Confusing wildcard with prefix query

4. You wrote this prefix query but it returns no results:

{ "query": { "prefix": { "title": "prog*" } } }

What is the error?

medium

A. Field name "title" is invalid

B. Prefix query should not include the asterisk (*)

C. Prefix queries require wildcard keyword

D. Prefix query must use match instead of prefix

Solution

1. Step 1: Understand prefix query syntax

   Prefix queries expect a string prefix without wildcards like '*'. The asterisk is not needed and causes no matches.

2. Step 2: Check other options

   Field name is assumed valid, wildcard keyword is different query type, and match query is unrelated to prefix syntax.

3. Final Answer:

   Prefix query should not include the asterisk (*) -> Option B

4. Quick Check:

   Prefix query uses plain prefix string, no * [OK]

Hint: Remove * from prefix query string to fix [OK]

Common Mistakes:

• Including * in prefix query string
• Confusing prefix with wildcard query
• Using match query instead of prefix

5. You want to find all documents where the "username" field starts with "alex" but also want to allow any characters after "alex" including none. Which query is best and why?

{ "query": { "wildcard": { "username": "alex*" } } }

or

{ "query": { "prefix": { "username": "alex" } } }

hard

A. Prefix query is better because it is faster and matches all starting with "alex"

B. Wildcard query is better because it matches "alex" exactly only

C. Wildcard query is better because it matches any characters including none after "alex"

D. Prefix query is better because it requires the * symbol

Solution

1. Step 1: Compare prefix and wildcard queries for this case

   Both queries match terms starting with "alex" and any characters after. Wildcard uses "alex*", prefix uses "alex" without *.

2. Step 2: Consider performance and usage

   Prefix queries are optimized and faster for this use case. Wildcard queries are slower and more flexible but unnecessary here.

3. Final Answer:

   Prefix query is better because it is faster and matches all starting with "alex" -> Option A

4. Quick Check:

   Prefix query faster for starts-with matching [OK]

Hint: Use prefix query for starts-with, wildcard for complex patterns [OK]

Common Mistakes:

• Using wildcard when prefix is enough
• Adding * in prefix query string
• Thinking wildcard matches exact only