# Filtering for wildcard domains

**URL:** <https://discuss.elastic.co/t/filtering-for-wildcard-domains/280834>\
**Category:** Elasticsearch\
**Created:** [August 9, 2021, 4:14pm UTC](https://discuss.elastic.co/t/filtering-for-wildcard-domains/280834 "2021-08-09T16:14:19Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [August 10, 2021, 11:35am UTC](https://discuss.elastic.co/t/filtering-for-wildcard-domains/280834/2 "2021-08-10T11:35:10Z")

</div>

Searching for ends of strings is expensive because it means we can't efficiently accelerate lookups using the index (which stores terms alphabetically based on the start of the string). We end up scanning all index entries.  
A way to counter that is to store a version of the strings which is reversed. It's a little clunky but here's an example mapping/doc/query that should be more efficient:

```auto
DELETE test
PUT test
{
  "settings": {
    "analysis": {
      "analyzer": {
        "reverser": {
          "tokenizer": "keyword",
          "filter": [
            "reverse"
          ]
        }
      }
    }
  },
  "mappings": {
    "properties": {
      "domain": {
        "type": "keyword",
        "fields": {
          "reversed": {
            "type": "text",
            "analyzer": "reverser"
          }
        }
      }
    }
  }
}
POST test/_analyze
{
  "field": "domain.reversed",
  "text": ["www.foo.com"]
}
POST test/_doc/1
{
  "domain":"www.foo.com"
}
POST test/_search
{
  "query": {
    "match_phrase_prefix": {"domain.reversed": "foo.com"}
  }
}

```

For multiple clauses you would use a `bool` query with multiple of the `match_phrase_prefix` clauses inside the `should` clause.

Another approach is to make use of the [new wildcard field](https://www.elastic.co/blog/find-strings-within-strings-faster-with-the-new-elasticsearch-wildcard-field) but, like most things this has trade-offs. These were discussed [here](https://discuss.elastic.co/t/suggestion-for-wildcard-field-type/280553/2) where the original question was related to your exact same problem (searching for ends of domain names).

---

_[View the full topic](https://discuss.elastic.co/t/filtering-for-wildcard-domains/280834)._