Elastic query DSL: Wildcards in terms filter?

Question

I am trying to filter the documents using terms filter. I am not sure how to introduce wildcards in filter. I tried something like this:

"filter":{
  "bool":{
       "must":{
          "terms":{
             "wildcard" :  {
                "aircraft":[
                   "a380*"
                ]
             }
         }
      }
   }
}

But I get SearchParseException with this. Is there no way to use wildcard within filter framework?

Beam

you query looks like prefix search. U can use ngram for it – Coercion

Answer 1

The terms filter doesn't support wildcards, queries do, though. Try this query instead

{
  "query": {
    "bool": {
      "must": {
        "wildcard": {
          "aircraft": "a380*"
        }
      }
    }
  }
}

Or if you absolutely need to use filters, you can try the regexp filter, too:

{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": {
            "regexp": {
              "aircraft": "a380.*"
            }
          }
        }
      }
    }
  }
}

UPDATE:

In latest ES versions, use the following query instead since filtered has been removed:

{
  "query": {
    "bool": {
      "filter": {
         "regexp": {
           "aircraft": "a380.*"
         }
      }
    }
  }
}

Kidd

regexp is a filter on its own, different from the terms filter. – Kidd

queries are exceptionally slower than filters. I guess instead of terms, I should go for multiple regexp under one 'should' block. – Beam

Queries and filters serve different purposes, the main goal of filters is to reduce the number of documents that have to be examined by the query. If your main use case is around searching text, queries are the way to go, but make sure to filter as much as you can so that queries run on as few documents as possible. – Kidd

Yes. I understand that. Actually my application is not meant for text analytics. Its using almost structured tabular data. I am doing a sort of benchmarking of elastic with splunk. – Beam

Gotcha. Comparing ES vs Splunk you'll get a big diff in the price tag ;-) – Kidd

Preliminary results show Elastic to be promising on the execution time point of view, but lacks well-packaged commands. Even though, I hope Elastic to win :P – Beam

Let us continue this discussion in chat. – Beam

Note that filtered has been removed since 5.0 (see https://mcmap.net/q/181229/-no-query-registered-for-filtered for the new version) – Vagrom