elasticsearch - How to handle wildcards in elastic search structured queries -

my use case requires query our elastic search domain trailing wildcards. wanted opinion on best practices of handling such wildcards in queries.

do think adding following clauses practice queries:

"query" : {      "query_string" : {          "query" :   "attribute:postfix*",         "analyze_wildcard" : true,         "allow_leading_wildcard" : false,         "use_dis_max" : false     }  } 

i've disallowed leading wildcards since heavy operation. wanted how analyzing wildcard every query request in long run. understanding is, analyze wildcard have no impact if query doesn't have wildcards. correct?

if have possibility of changing mapping type , index settings, right way go create custom analyzer edge-n-gram token filter index prefixes of attribute field.

curl -xput http://localhost:9200/your_index -d '{     "settings": {         "analysis": {             "filter": {                 "edge_filter": {                     "type": "edgengram",                     "min_gram": 1,                     "max_gram": 15                 }             },             "analyzer": {                 "attr_analyzer": {                     "type": "custom",                     "tokenizer": "standard",                     "filter": ["lowercase", "edge_filter"]                 }             }         }     },     "mappings": {         "your_type": {             "properties": {                 "attribute": {                     "type": "string",                     "analyzer": "attr_analyzer",                     "search_analyzer": "standard"                 }             }         }     } }' 

then, when index document, attribute field value (e.g.) postfixing indexed following tokens: p, po, pos, post, postf, postfi, postfix, postfixi, postfixin, postfixing.

finally, can query attribute field postfix value using simple match query this. no need use under-performing wildcard in query string query.

{   "query": {      "match" : {         "attribute" : "postfix"      }   } }