Is there a query filter for suffix?

Elastic Stack Elasticsearch
1

I have been reading about the term level queries at
https://www.elastic.co/guide/en/elasticsearch/reference/current/term-level-queries.html

The cardinaility of our aggregation buckets is very high and blows up in memory, so I have been using a query filter with a prefix filter to divide and conquer the aggregation. So for example, to divide the bucket set by 10, I use the prefixes 0 through 9 to filter the data set before aggregating. To divide the bucket set by 100, I use the prefixes 00 through 99 to filter the data set before aggregating.

However, I notice our data set is not uniformly distributed by prefix. For example, prefixes of 0, 1, and 2 are most common. Prefixes of 7 through 9 are non-existent in our data set.

Is there a query boolean filter for suffix? I think our data set is more uniformly distributed over ending digits than preceding digits. I have see the wildcard and regex filters, but I think the time to run the filter might increase drastically.

Thanks, Dan

2

Nope, there's no equivalent query for suffix, since there's no good/efficient way to make that work given the inverted index structure we have today. You could use a wildcard/regex as you mentioned, but it would indeed be relatively expensive.

If you need fast, indexed suffix search, the recommended trick is to add a multi-field to your mapping which includes a reverse token filter. Then you can run prefix queries on that reversed field and essentially get suffix search in an optimized manner.

The downside is that you have to add another field to your mapping, and any "old" data needs to be reindexed to have the new field.

2 Likes