Why Wildcard and prefix queries in Elasticsearch? - Purpose & Use Cases

The Big Idea

What if you could find anything in a huge pile of data just by typing a few letters?

The Scenario

Imagine you have a huge library catalog and you want to find all books that start with "Harry" or contain "magic" anywhere in the title. Without special search tools, you'd have to look at every single title one by one.

The Problem

Manually scanning through thousands or millions of entries is slow and tiring. You might miss some matches or make mistakes. It's like trying to find a needle in a haystack without a magnet.

The Solution

Wildcard and prefix queries let you search with patterns. You can ask Elasticsearch to find all words starting with "Harry" or containing "magic" anywhere, quickly and accurately, without checking each item manually.

Before vs After

✗ Before

Search each title manually for 'Harry' or 'magic'

✓ After

{ "query": { "wildcard": { "title": "harry*" } } }

What It Enables

This makes searching flexible and fast, letting you find partial matches and patterns easily in huge datasets.

Real Life Example

Online stores use prefix queries to show product suggestions as you type, like finding all shoes starting with "run" instantly.

Key Takeaways

Manual searching is slow and error-prone.

Wildcard and prefix queries let you search by patterns.

They make finding partial matches fast and easy.

Practice

1. What does a wildcard query with * symbol do in Elasticsearch?

easy

A. Matches terms ending with a specific suffix

B. Matches only the exact search term

C. Matches terms starting with a specific prefix

D. Matches any sequence of characters in the search term

Solution

1. Step 1: Understand the wildcard symbol *

   The * symbol in wildcard queries matches zero or more characters in any position of the term.

2. Step 2: Compare with other options

   Exact match requires no wildcard, prefix queries use a different query type, and suffix matching is not directly done by * alone.

3. Final Answer:

   Matches any sequence of characters in the search term -> Option D

4. Quick Check:

   wildcard * = match any chars [OK]

Hint: Remember * matches any characters, ? matches one character [OK]

Common Mistakes:

• Confusing wildcard * with prefix query
• Thinking * matches only one character
• Assuming wildcard matches exact terms only

2. Which of the following is the correct syntax for a prefix query in Elasticsearch?

easy

A. { "prefix": { "field_name": "pre" } }

B. { "wildcard": { "field_name": "pre*" } }

C. { "match": { "field_name": "pre*" } }

D. { "term": { "field_name": "pre*" } }

Solution

1. Step 1: Identify prefix query syntax

   Prefix queries use the prefix keyword with the field and the prefix string.

2. Step 2: Check other options

   Wildcard queries use wildcard, match and term queries do not support prefix syntax with asterisk.

3. Final Answer:

   { "prefix": { "field_name": "pre" } } -> Option A

4. Quick Check:

   prefix query uses "prefix" keyword [OK]

Hint: Prefix queries use "prefix" keyword, not wildcard or match [OK]

Common Mistakes:

• Using wildcard syntax for prefix query
• Using match query with asterisk
• Confusing term query with prefix query

3. Given the following wildcard query, which documents will match?

{ "query": { "wildcard": { "name": "jo?n*" } } }

Assuming documents have names: "john", "joan", "jonas", "joanathan", "jo".

medium

A. ["joan", "jonas", "joanathan"]

B. ["john", "joan", "jo"]

C. ["john", "joan", "joanathan"]

D. ["john", "joan", "jonas", "joanathan", "jo"]

Solution

1. Step 1: Analyze the wildcard pattern "jo?n*"

   The pattern means: 'jo' followed by any single character (due to '?'), then 'n', then any characters (due to '*').

2. Step 2: Check each name against the pattern

   "john" matches ('h' replaces '?'), "joan" matches ('a' replaces '?'), "joanathan" matches ('a' replaces '?'). "jonas" does not match ('n' replaces '?' but next 'a' ≠ 'n'). "jo" is too short to match.

3. Final Answer:

   ["john", "joan", "joanathan"] -> Option C

4. Quick Check:

   wildcard ? = one char, * = any chars [OK]

Hint: ? matches one char, * matches zero or more chars [OK]

Common Mistakes:

• Assuming ? matches zero characters
• Including too short strings like "jo"
• Confusing wildcard with prefix query

4. You wrote this prefix query but it returns no results:

{ "query": { "prefix": { "title": "prog*" } } }

What is the error?

medium

A. Field name "title" is invalid

B. Prefix query should not include the asterisk (*)

C. Prefix queries require wildcard keyword

D. Prefix query must use match instead of prefix

Solution

1. Step 1: Understand prefix query syntax

   Prefix queries expect a string prefix without wildcards like '*'. The asterisk is not needed and causes no matches.

2. Step 2: Check other options

   Field name is assumed valid, wildcard keyword is different query type, and match query is unrelated to prefix syntax.

3. Final Answer:

   Prefix query should not include the asterisk (*) -> Option B

4. Quick Check:

   Prefix query uses plain prefix string, no * [OK]

Hint: Remove * from prefix query string to fix [OK]

Common Mistakes:

• Including * in prefix query string
• Confusing prefix with wildcard query
• Using match query instead of prefix

5. You want to find all documents where the "username" field starts with "alex" but also want to allow any characters after "alex" including none. Which query is best and why?

{ "query": { "wildcard": { "username": "alex*" } } }

or

{ "query": { "prefix": { "username": "alex" } } }

hard

A. Prefix query is better because it is faster and matches all starting with "alex"

B. Wildcard query is better because it matches "alex" exactly only

C. Wildcard query is better because it matches any characters including none after "alex"

D. Prefix query is better because it requires the * symbol

Solution

1. Step 1: Compare prefix and wildcard queries for this case

   Both queries match terms starting with "alex" and any characters after. Wildcard uses "alex*", prefix uses "alex" without *.

2. Step 2: Consider performance and usage

   Prefix queries are optimized and faster for this use case. Wildcard queries are slower and more flexible but unnecessary here.

3. Final Answer:

   Prefix query is better because it is faster and matches all starting with "alex" -> Option A

4. Quick Check:

   Prefix query faster for starts-with matching [OK]

Hint: Use prefix query for starts-with, wildcard for complex patterns [OK]

Common Mistakes:

• Using wildcard when prefix is enough
• Adding * in prefix query string
• Thinking wildcard matches exact only