Prefix query on fields mapped as keyword

Elastic Search
1

Hello,
I use Elasticsearch version 7.17.
In a Elasticsearch blog post ( Find strings within strings faster with the Elasticsearch wildcard field | Elastic Blog ) it's mentioned that keyword fields can offer better performance for prefix queries compared to wildcard fields. However, I couldn't find direct confirmation of this in the official Elasticsearch docs.
Are keyword fields indeed optimized for prefix searches? If so, which query type should be used when searching by the beginning of a string in keyword fields: prefix query, wildcard query?
Thanks

2

I think the blog post does a good job of explaining what is happening and why.

If you need more information, you can check out issues and discussions that have been raised in Github. If you still want to go even further to answer questions about your specific use case you can check out Rally to run benchmarking against your use cases.

3

Thank you for your reply.
I have another question related to this topic.

I have a mapping for an index test_index as follows:

{
  "mappings": {
    "properties": {
      "field1": { "type": "keyword" }
    }
  }
}

I have disabled expensive queries by setting search.allow_expensive_queries to false . When running a prefix query against field1 , which is of type keyword , like this:

GET test_index/_search 
{"query": {"bool": {"filter": [
  {"prefix": {
    "field1": "test"
  }}
]}}
}

I received the following error message:

    "root_cause" : [
      {
        "type" : "exception",
        "reason" : "[prefix] queries cannot be executed when 'search.allow_expensive_queries' is set to false. For optimised prefix queries on text fields please enable [index_prefixes]."
      }
    ]

I'm puzzled by this error because my query targets a keyword field, not a text field, and index_prefixes is not applicable to keyword fields. Can you help me understand why this error is occurring and how to resolve it?

4

You need to enable it if you want to use prefix queries on keyword fields as mentioned in the documentation.

prefix queries (except on wildcard fields or those without index_prefixes)

Running a prefix query on a field that is not a wildcard field or a text field with index_prefixes needs to have search.allow_expensive_queries set as true.

5

So, prefix queries against keyword fields are considered expensive. However, the article I referenced in my initial post ( Find strings within strings faster with the Elasticsearch wildcard field | Elastic Blog ) describes prefix queries on keyword fields as 'fast' and on wildcard fields as 'not quite as fast'. This appears contradictory.

Why there is such a discrepancy in the performance descriptions of prefix queries on keyword fields? Is there a specific context or configuration where prefix queries on keyword fields can indeed perform efficiently?

Additionally, I am curious about why the index_prefixes option is not available for keyword fields, whereas it is available for text fields. What is the technical reason behind this?

Thank you for any insights or clarifications.

6

You can speed up prefix queries using index mappings. It will be faster than straight up wildcard search.