# Finding substring achored at beginning of field **URL:** \ **Category:** Elasticsearch\ **Created:** [May 8, 2012, 9:56pm UTC](https://discuss.elastic.co/t/finding-substring-achored-at-beginning-of-field/7605 "2012-05-08T21:56:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Dennis](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@Dennis](https://discuss.elastic.co/u/Dennis)\ **Post date:** [May 8, 2012, 9:56pm UTC](https://discuss.elastic.co/t/finding-substring-achored-at-beginning-of-field/7605/1 "2012-05-08T21:56:26Z")
I would like to query/filter based on the beginning of a string in arrays, like so: Items stored look like: { "name":"some name", "permissions":[ "group\_resource\_permission", "group\_resource\_permission", "group\_resource\_permission", ] } I want to defeat somebody who might name their domain/resource, "group\_targetGroup\_resource\_permission", which if allowed, would allow them to match permission queries based on 'targetGroup' or 'targetGroup\_resource\_permission'. Forcing the searched for string in a list of permissions to BEGIN at the beginning of the string would be what I am after. I _COULD_ prefix each permission with a punctuation character, disallowing it INSIDE of group, resource, or permission names, and may yet do that. Ex. { "name":"some name", "permissions":[ "~group\_resource\_permission", "~group\_resource\_permission", "~group\_resource\_permission", ] } AUTHORIZATION\_ANCHOR="~"; AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; Then queries/filters are post pended with an additional term for permissions: " AND " + AUTHORIZATION\_ANCHOR + user.group() + AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; But it's cooler and a good learning experience to gain the knowledge on how to do it in a query/filter. In any case, which will be faster, and which will use less memory, a query based approach, or a filter based approach? (I don't need or want ranking based on permissions). ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [May 10, 2012, 6:06am UTC](https://discuss.elastic.co/t/finding-substring-achored-at-beginning-of-field/7605/2 "2012-05-10T06:06:50Z")
You could just have the permissions field to be not\_analyzed in the mappings, and then it will do an exact match. Is that what you are after? Regarding filters vs. queries, filters are cached, so if you have a recurring cases of permissions, then filters make more sense. Last, why do you build your query using the query parser string syntax? Things like that are perfect for building it using the query DSL. On Wed, May 9, 2012 at 12:56 AM, Dennis [gearond@gmail.com](mailto:gearond@gmail.com) wrote: > I would like to query/filter based on the beginning of a string in arrays, > like so: > > Items stored look like: > > { > "name":"some name", > "permissions":[ > "group\_resource\_permission", > "group\_resource\_permission", > "group\_resource\_permission", > ] > } > > > > I want to defeat somebody who might name their domain/resource, > "group\_targetGroup\_resource\_permission", > which if allowed, would allow them to match permission queries based on > 'targetGroup' or 'targetGroup\_resource\_permission'. > Forcing the searched for string in a list of permissions to BEGIN at the > beginning of the string would be what I am after. > > > > I _COULD_ prefix each permission with a punctuation character, disallowing > it INSIDE of group, resource, or permission names, and may yet do that. > Ex. > { > "name":"some name", > "permissions":[ > "~group\_resource\_permission", > "~group\_resource\_permission", > "~group\_resource\_permission", > ] > } > AUTHORIZATION\_ANCHOR="~"; > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > Then queries/filters are post pended with an additional term for > permissions: > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > But it's cooler and a good learning experience to gain the knowledge on > how to do it in a query/filter. > > > > In any case, which will be faster, and which will use less memory, a query > based approach, or a filter based approach? (I don't need or want ranking > based on permissions). ---
**Author:** ![Dennis](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@Dennis](https://discuss.elastic.co/u/Dennis)\ **Post date:** [May 17, 2012, 3:12am UTC](https://discuss.elastic.co/t/finding-substring-achored-at-beginning-of-field/7605/3 "2012-05-17T03:12:12Z")
I actually did not put a query in my email. Those were JSON representations of Java class attributes. I don't have a preference over query string vs Query DSL. What I was trying to say in my original post is that I'd like to at least search for exact match of a substring, which starts at the beginning of the string. And I'd like to do that in an array, if possible, but I could do it in a long string also. On Thursday, May 10, 2012 1:06:50 AM UTC-5, kimchy wrote: > You could just have the permissions field to be not\_analyzed in the > mappings, and then it will do an exact match. Is that what you are after? > > Regarding filters vs. queries, filters are cached, so if you have > a recurring cases of permissions, then filters make more sense. > > Last, why do you build your query using the query parser string syntax? > Things like that are perfect for building it using the query DSL. > > On Wed, May 9, 2012 at 12:56 AM, Dennis [gearond@gmail.com](mailto:gearond@gmail.com) wrote: > > > I would like to query/filter based on the beginning of a string in > > arrays, like so: > > > > Items stored look like: > > > > { > > "name":"some name", > > "permissions":[ > > "group\_resource\_permission", > > "group\_resource\_permission", > > "group\_resource\_permission", > > ] > > } > > > > > > > > I want to defeat somebody who might name their domain/resource, > > "group\_targetGroup\_resource\_permission", > > which if allowed, would allow them to match permission queries based on > > 'targetGroup' or 'targetGroup\_resource\_permission'. > > Forcing the searched for string in a list of permissions to BEGIN at the > > beginning of the string would be what I am after. > > > > > > > > I _COULD_ prefix each permission with a punctuation character, > > disallowing it INSIDE of group, resource, or permission names, and may yet > > do that. > > Ex. > > { > > "name":"some name", > > "permissions":[ > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > ] > > } > > AUTHORIZATION\_ANCHOR="~"; > > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > > > > > Then queries/filters are post pended with an additional term for > > permissions: > > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > > > > > But it's cooler and a good learning experience to gain the knowledge on > > how to do it in a query/filter. > > > > > > > > In any case, which will be faster, and which will use less memory, a > > query based approach, or a filter based approach? (I don't need or want > > ranking based on permissions). ---
**Author:** ![Dennis](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@Dennis](https://discuss.elastic.co/u/Dennis)\ **Post date:** [May 17, 2012, 3:12am UTC](https://discuss.elastic.co/t/finding-substring-achored-at-beginning-of-field/7605/4 "2012-05-17T03:12:47Z")
On Tuesday, May 8, 2012 4:56:26 PM UTC-5, Dennis wrote: > I would like to query/filter based on the beginning of a string in arrays, > like so: > > Items stored look like: > > { > "name":"some name", > "permissions":[ > "group\_resource\_permission", > "group\_resource\_permission", > "group\_resource\_permission", > ] > } > > > > I want to defeat somebody who might name their domain/resource, > "group\_targetGroup\_resource\_permission", > which if allowed, would allow them to match permission queries based on > 'targetGroup' or 'targetGroup\_resource\_permission'. > Forcing the searched for string in a list of permissions to BEGIN at the > beginning of the string would be what I am after. > > > > I _COULD_ prefix each permission with a punctuation character, disallowing > it INSIDE of group, resource, or permission names, and may yet do that. > Ex. > { > "name":"some name", > "permissions":[ > "~group\_resource\_permission", > "~group\_resource\_permission", > "~group\_resource\_permission", > ] > } > AUTHORIZATION\_ANCHOR="~"; > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > Then queries/filters are post pended with an additional term for > permissions: > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > But it's cooler and a good learning experience to gain the knowledge on > how to do it in a query/filter. > > > > In any case, which will be faster, and which will use less memory, a query > based approach, or a filter based approach? (I don't need or want ranking > based on permissions). On Tuesday, May 8, 2012 4:56:26 PM UTC-5, Dennis wrote: > I would like to query/filter based on the beginning of a string in arrays, > like so: > > > > Items stored look like: > > { > "name":"some name", > "permissions":[ > "group\_resource\_permission", > "group\_resource\_permission", > "group\_resource\_permission", > ] > } > > > > I want to defeat somebody who might name their domain/resource, > "group\_targetGroup\_resource\_permission", > which if allowed, would allow them to match permission queries based on > 'targetGroup' or 'targetGroup\_resource\_permission'. > Forcing the searched for string in a list of permissions to BEGIN at the > beginning of the string would be what I am after. > > > > I _COULD_ prefix each permission with a punctuation character, disallowing > it INSIDE of group, resource, or permission names, and may yet do that. > Ex. > { > "name":"some name", > "permissions":[ > "~group\_resource\_permission", > "~group\_resource\_permission", > "~group\_resource\_permission", > ] > } > AUTHORIZATION\_ANCHOR="~"; > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > Then queries/filters are post pended with an additional term for > permissions: > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > But it's cooler and a good learning experience to gain the knowledge on > how to do it in a query/filter. > > > > In any case, which will be faster, and which will use less memory, a query > based approach, or a filter based approach? (I don't need or want ranking > based on permissions). On Tuesday, May 8, 2012 4:56:26 PM UTC-5, Dennis wrote: > I would like to query/filter based on the beginning of a string in arrays, > like so: > > > > Items stored look like: > > { > "name":"some name", > "permissions":[ > "group\_resource\_permission", > "group\_resource\_permission", > "group\_resource\_permission", > ] > } > > > > I want to defeat somebody who might name their domain/resource, > "group\_targetGroup\_resource\_permission", > which if allowed, would allow them to match permission queries based on > 'targetGroup' or 'targetGroup\_resource\_permission'. > Forcing the searched for string in a list of permissions to BEGIN at the > beginning of the string would be what I am after. > > > > I _COULD_ prefix each permission with a punctuation character, disallowing > it INSIDE of group, resource, or permission names, and may yet do that. > Ex. > { > "name":"some name", > "permissions":[ > "~group\_resource\_permission", > "~group\_resource\_permission", > "~group\_resource\_permission", > ] > } > AUTHORIZATION\_ANCHOR="~"; > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > Then queries/filters are post pended with an additional term for > permissions: > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > But it's cooler and a good learning experience to gain the knowledge on > how to do it in a query/filter. > > > > In any case, which will be faster, and which will use less memory, a query > based approach, or a filter based approach? (I don't need or want ranking > based on permissions). On Tuesday, May 8, 2012 4:56:26 PM UTC-5, Dennis wrote: > I would like to query/filter based on the beginning of a string in arrays, > like so: > > > > Items stored look like: > > { > "name":"some name", > "permissions":[ > "group\_resource\_permission", > "group\_resource\_permission", > "group\_resource\_permission", > ] > } > > > > I want to defeat somebody who might name their domain/resource, > "group\_targetGroup\_resource\_permission", > which if allowed, would allow them to match permission queries based on > 'targetGroup' or 'targetGroup\_resource\_permission'. > Forcing the searched for string in a list of permissions to BEGIN at the > beginning of the string would be what I am after. > > > > I _COULD_ prefix each permission with a punctuation character, disallowing > it INSIDE of group, resource, or permission names, and may yet do that. > Ex. > { > "name":"some name", > "permissions":[ > "~group\_resource\_permission", > "~group\_resource\_permission", > "~group\_resource\_permission", > ] > } > AUTHORIZATION\_ANCHOR="~"; > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > Then queries/filters are post pended with an additional term for > permissions: > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > But it's cooler and a good learning experience to gain the knowledge on > how to do it in a query/filter. > > > > In any case, which will be faster, and which will use less memory, a query > based approach, or a filter based approach? (I don't need or want ranking > based on permissions). ---
**Author:** ![Dennis](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@Dennis](https://discuss.elastic.co/u/Dennis)\ **Post date:** [May 17, 2012, 3:14am UTC](https://discuss.elastic.co/t/finding-substring-achored-at-beginning-of-field/7605/5 "2012-05-17T03:14:45Z")
Sorry about posting the original message with no reply in it, AFTER I did reply. I'm beginning to not like the new google groups interface. On Wednesday, May 16, 2012 10:12:47 PM UTC-5, Dennis wrote: > On Tuesday, May 8, 2012 4:56:26 PM UTC-5, Dennis wrote: > > > I would like to query/filter based on the beginning of a string in > > arrays, like so: > > > > Items stored look like: > > > > { > > "name":"some name", > > "permissions":[ > > "group\_resource\_permission", > > "group\_resource\_permission", > > "group\_resource\_permission", > > ] > > } > > > > > > > > I want to defeat somebody who might name their domain/resource, > > "group\_targetGroup\_resource\_permission", > > which if allowed, would allow them to match permission queries based on > > 'targetGroup' or 'targetGroup\_resource\_permission'. > > Forcing the searched for string in a list of permissions to BEGIN at the > > beginning of the string would be what I am after. > > > > > > > > I _COULD_ prefix each permission with a punctuation character, > > disallowing it INSIDE of group, resource, or permission names, and may yet > > do that. > > Ex. > > { > > "name":"some name", > > "permissions":[ > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > ] > > } > > AUTHORIZATION\_ANCHOR="~"; > > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > > > > > Then queries/filters are post pended with an additional term for > > permissions: > > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > > > > > But it's cooler and a good learning experience to gain the knowledge on > > how to do it in a query/filter. > > > > > > > > In any case, which will be faster, and which will use less memory, a > > query based approach, or a filter based approach? (I don't need or want > > ranking based on permissions). > > > > On Tuesday, May 8, 2012 4:56:26 PM UTC-5, Dennis wrote: > > > > > I would like to query/filter based on the beginning of a string in > > arrays, like so: > > > > > > > > Items stored look like: > > > > { > > "name":"some name", > > "permissions":[ > > "group\_resource\_permission", > > "group\_resource\_permission", > > "group\_resource\_permission", > > ] > > } > > > > > > > > I want to defeat somebody who might name their domain/resource, > > "group\_targetGroup\_resource\_permission", > > which if allowed, would allow them to match permission queries based on > > 'targetGroup' or 'targetGroup\_resource\_permission'. > > Forcing the searched for string in a list of permissions to BEGIN at the > > beginning of the string would be what I am after. > > > > > > > > I _COULD_ prefix each permission with a punctuation character, > > disallowing it INSIDE of group, resource, or permission names, and may yet > > do that. > > Ex. > > { > > "name":"some name", > > "permissions":[ > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > ] > > } > > AUTHORIZATION\_ANCHOR="~"; > > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > > > > > Then queries/filters are post pended with an additional term for > > permissions: > > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > > > > > But it's cooler and a good learning experience to gain the knowledge on > > how to do it in a query/filter. > > > > > > > > In any case, which will be faster, and which will use less memory, a > > query based approach, or a filter based approach? (I don't need or want > > ranking based on permissions). > > > > On Tuesday, May 8, 2012 4:56:26 PM UTC-5, Dennis wrote: > > > > > I would like to query/filter based on the beginning of a string in > > arrays, like so: > > > > > > > > Items stored look like: > > > > { > > "name":"some name", > > "permissions":[ > > "group\_resource\_permission", > > "group\_resource\_permission", > > "group\_resource\_permission", > > ] > > } > > > > > > > > I want to defeat somebody who might name their domain/resource, > > "group\_targetGroup\_resource\_permission", > > which if allowed, would allow them to match permission queries based on > > 'targetGroup' or 'targetGroup\_resource\_permission'. > > Forcing the searched for string in a list of permissions to BEGIN at the > > beginning of the string would be what I am after. > > > > > > > > I _COULD_ prefix each permission with a punctuation character, > > disallowing it INSIDE of group, resource, or permission names, and may yet > > do that. > > Ex. > > { > > "name":"some name", > > "permissions":[ > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > ] > > } > > AUTHORIZATION\_ANCHOR="~"; > > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > > > > > Then queries/filters are post pended with an additional term for > > permissions: > > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > > > > > But it's cooler and a good learning experience to gain the knowledge on > > how to do it in a query/filter. > > > > > > > > In any case, which will be faster, and which will use less memory, a > > query based approach, or a filter based approach? (I don't need or want > > ranking based on permissions). > > > > On Tuesday, May 8, 2012 4:56:26 PM UTC-5, Dennis wrote: > > > > > I would like to query/filter based on the beginning of a string in > > arrays, like so: > > > > > > > > Items stored look like: > > > > { > > "name":"some name", > > "permissions":[ > > "group\_resource\_permission", > > "group\_resource\_permission", > > "group\_resource\_permission", > > ] > > } > > > > > > > > I want to defeat somebody who might name their domain/resource, > > "group\_targetGroup\_resource\_permission", > > which if allowed, would allow them to match permission queries based on > > 'targetGroup' or 'targetGroup\_resource\_permission'. > > Forcing the searched for string in a list of permissions to BEGIN at the > > beginning of the string would be what I am after. > > > > > > > > I _COULD_ prefix each permission with a punctuation character, > > disallowing it INSIDE of group, resource, or permission names, and may yet > > do that. > > Ex. > > { > > "name":"some name", > > "permissions":[ > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > "~group\_resource\_permission", > > ] > > } > > AUTHORIZATION\_ANCHOR="~"; > > AUTHORIZATION\_ELEMENT\_SEPARATOR="\_"; > > > > > > > > Then queries/filters are post pended with an additional term for > > permissions: > > " AND " + AUTHORIZATION\_ANCHOR + user.group() + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + Optional\_resource + > > AUTHORIZATION\_ELEMENT\_SEPARATOR + optional\_permission; > > > > > > > > But it's cooler and a good learning experience to gain the knowledge on > > how to do it in a query/filter. > > > > > > > > In any case, which will be faster, and which will use less memory, a > > query based approach, or a filter based approach? (I don't need or want > > ranking based on permissions). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 3:28am UTC](https://discuss.elastic.co/t/finding-substring-achored-at-beginning-of-field/7605/6 "2017-07-06T03:28:26Z")