# How to increase the speed of response? **URL:** \ **Category:** Elasticsearch\ **Created:** [September 7, 2024, 2:13pm UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190 "2024-09-07T14:13:08Z")\ **Posts on this page:** 12\ **Page:** 2
**Author:** ![octavian-nita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/octavian-nita/32/67043_2.png) [@octavian-nita](https://discuss.elastic.co/u/octavian-nita)\ **Post date:** [September 11, 2024, 9:21am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/22 "2024-09-11T09:21:09Z")
While better hardware will undoubtedly help, I fully endorse (based on personal experience) finding alternatives to the `wildcard` query for **partial** string/substring matching, which can quickly become slow and otherwise resource-intensive, especially when using _ **leading wildcards** _. Among options: 1. If you _need_ to use wildcard queries, consider using the `wildcard` type for those fields that you query (assuming you don't query the whole `_source` and that you're using Elasticsearch v7.9 or later); see [Find strings within strings faster with the Elasticsearch wildcard field | Elastic Blog](https://www.elastic.co/blog/find-strings-within-strings-faster-with-the-new-elasticsearch-wildcard-field) for a nice intro. It's important to note that you need to _ **reindex** _ your dataset for these changes to take effect. 2. Use `fuzzy` queries; I have yet to use them myself, so I don't have any experience with them, but they can prove slow for large datasets, and adjusting the `fuzziness` attribute value could help balance accuracy and performance. 3. Use `match` queries and _ **custom analyzers** _ to index fields as _**(edge-)N-grams**_; this is likely one of the most convenient solutions; you can use the analyze API ([Test an analyzer | Elasticsearch Guide [8.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/test-analyzer.html)) to test your analyzers. You also need to reindex your dataset. Watch out for situations where your indexing results in an abundance of tokens due to the extensive character count (e.g., min\_gram=2, max\_gram=10); you can eventually mitigate by using n-gram with a low min\_gram - max\_gram range (e.g., 3 to 10 characters) or adding a search-as-you-type field. In any case, you should thoroughly analyze the requirements to fine-tune the analyzers and queries—maybe not all fields need to be indexed, etc. Additional resources: - [Elasticsearch Query Partial Match](https://opster.com/guides/elasticsearch/how-tos/elasticsearch-query-partial-match) - [Guidance on partial keyword search](https://discuss.elastic.co/t/guidance-on-partial-keyword-search/351094) Good luck! ---
**Author:** ![dsagent](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Post date:** [September 11, 2024, 3:30pm UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/23 "2024-09-11T15:30:57Z")
If I have data like this { "gmail": "dsagent [esdkh@gmail.com](mailto:esdkh@gmail.com)" } { "gmail": "dsagent [esdkh@gmail.org](mailto:esdkh@gmail.org)" } And I want to bring the email that contains in es and at the end .com Is there a way other than wildcard ? ---
**Author:** ![octavian-nita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/octavian-nita/32/67043_2.png) [@octavian-nita](https://discuss.elastic.co/u/octavian-nita)\ **Post date:** [September 12, 2024, 7:26am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/24 "2024-09-12T07:26:07Z")
If this is, indeed, how your searched fields look like, a wildcard query might not necessarily be the problem (since the value sizes/lengths are rather small). I would still map `gmail` as a wildcard field (see [Find strings within strings faster with the Elasticsearch wildcard field | Elastic Blog](https://www.elastic.co/blog/find-strings-within-strings-faster-with-the-new-elasticsearch-wildcard-field), [Keyword type family | Elasticsearch Guide [8.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.15/keyword.html#wildcard-field-type)) and then query it with a regular wildcard query. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 12, 2024, 7:30am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/25 "2024-09-12T07:30:17Z")
If you know exactly what you are seraching for with the wildcard and do this frequently, why not parse that out into a separate field when you index so you can instead use an efficient term query? ---
**Author:** ![dsagent](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Post date:** [September 12, 2024, 8:07am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/26 "2024-09-12T08:07:21Z")
I am looking for an email and a URL Can you give me an example? ---
**Author:** ![dsagent](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Post date:** [September 12, 2024, 8:17am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/27 "2024-09-12T08:17:26Z")
Yes, the data looks like this, but I'm not searching by wildcard Example: GET insex\_name/\_search { "query": { "bool": { "must": [ { "wildcard": { "email": { "value": "_esdkh_" } } }, { "wildcard": { "email": { "value": "\*.org" # or .com ...... } } } ] } } } ---
**Author:** ![octavian-nita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/octavian-nita/32/67043_2.png) [@octavian-nita](https://discuss.elastic.co/u/octavian-nita)\ **Post date:** [September 13, 2024, 9:38am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/28 "2024-09-13T09:38:36Z")
Well, it seems you know what/where you are searching, so, as @Christian_Dahlqvist points out, the most sensible approach would be to parse/separate those email parts into separate fields, either via your front app (in case you have one) or by using `logstash` to ingest data. (In any case, if you're not using wildcards in a query input, then don't use the `wildcard` query at all, a `match` query will do.) Alternatively (and for the sake of the example), you can (re)define your index mapping with settings/analyzers/token filters to customize the indexing of the `email` field (in what follows, I assume you want to search in the email [local-part](https://en.wikipedia.org/wiki/Email_address#Local-part) and the [top-level domain](https://en.wikipedia.org/wiki/Top-level_domain)): ```json { "settings": { "analysis": { "filter": { "email_parts_flt": { "type": "multiplexer", "preserve_original": false, "filters": ["email_local-part_flt, email_local-part_tokens_flt", "email_tld_flt"] }, "email_local-part_flt": { "type": "pattern_capture", "preserve_original": false, "patterns": ["([^@]*)@"] }, "email_local-part_tokens_flt": { "type": "word_delimiter_graph", "split_on_case_change": false, "split_on_numerics": false }, "email_tld_flt": { "type": "pattern_capture", "preserve_original": false, "patterns": ["(\\.[-A-Za-z0-9]+)$"] } }, "analyzer": { "email_analyzer": { "tokenizer": "keyword", "filter": ["email_parts_flt", "lowercase", "unique"] }, "email_search_analyzer": { "tokenizer": "standard", "filter": ["lowercase"] } } } }, "mappings": { "dynamic": "strict", "properties": { "email": { "type": "text", "analyzer": "email_analyzer", "search_analyzer": "email_search_analyzer" } } } } ``` (don't forget to re-index your existing data, if any). Testing the `email_analyzer` like: ```json POST /_analyze { "analyzer": "email_analyzer", "text": "dsagent esdkh-XY.foo@gmail.Bar.com" } ``` yields the following tokens that index the email value above: ```json { "tokens": [ { "token": "dsagent", "start_offset": 0, "end_offset": 34, "type": "word", "position": 0 }, { "token": "esdkh", "start_offset": 0, "end_offset": 34, "type": "word", "position": 1 }, { "token": "xy", "start_offset": 0, "end_offset": 34, "type": "word", "position": 2 }, { "token": "foo", "start_offset": 0, "end_offset": 34, "type": "word", "position": 3 }, { "token": ".com", "start_offset": 0, "end_offset": 34, "type": "word", "position": 3 } ] } ``` That means if inputted, any of those tokens would match your document with a simple `match` query. The solution avoids wildcard queries and moves the burden to the ingestion/indexing phase, but I feel it becomes a bit overstretched and not very easy to read and understand. ---
**Author:** ![dsagent](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Post date:** [September 14, 2024, 6:25am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/29 "2024-09-14T06:25:02Z")
> [@octavian-nita](#): > > The solution avoids wildcard queries and moves the burden to the ingestion/indexing phase, but I feel it becomes a bit overstretched and not very easy to read and understand. Thank you very much I'll try this. ---
**Author:** ![dsagent](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Post date:** [September 14, 2024, 7:37am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/30 "2024-09-14T07:37:02Z")
I want to query about dsdkh and .com how to query without using wildcard ? ---
**Author:** ![dsagent](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Post date:** [September 14, 2024, 3:58pm UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/31 "2024-09-14T15:58:47Z")
It didn't work. I made this query but it did not bring any data POST /index/\_search { "query": { "bool": { "must": [ { "match": { "email": "_smith_" } }, { "wildcard": { "email": "_smith_.com" } } ] } } } ---
**Author:** ![octavian-nita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/octavian-nita/32/67043_2.png) [@octavian-nita](https://discuss.elastic.co/u/octavian-nita)\ **Post date:** [September 23, 2024, 7:57am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/32 "2024-09-23T07:57:23Z")
Try with a query like: ```auto { "query": { "bool": { "must": [ { "match": { "email": "smith" } }, { "match": { "email": ".com" } } ] } } } ``` It might also improve the match if you removed the `"email_search_analyzer"` entry from the settings above. I.e., tell Elasticsearch to use the same analyzer on the input. Having said that, I think you should read a bit about how Elasticsearch matches things (maybe here: [Understanding and Working with Match Queries | by Madhusudhan Konda | Medium](https://mkonda007.medium.com/understanding-and-working-with-match-queries-266937b3f7eb), etc.). ---
**Author:** ![dsagent](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Post date:** [September 24, 2024, 7:25am UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190/33 "2024-09-24T07:25:13Z")
ok, thank you [Previous page](https://discuss.elastic.co/t/how-to-increase-the-speed-of-response/366190.md?page=1)