Prefix query #

Returns documents that contain a specific prefix in a provided field.

Use it when the values share a known beginning — a hostname family, an ID scheme, a URL section — and you want every term that starts with it.

Inside a nested query: not supported yet — the clause is rejected with an HTTP 400 naming the offending clause.

How it works #

The prefix is expanded against the inverted index’s term dictionary. Because the dictionary is kept in sorted order, the expansion is an ordered seek to the first term greater than or equal to the prefix, followed by reading the subtree of terms that start with it — no scan of the whole dictionary. Each expanded term’s postings are then unioned (OR semantics), exactly as if you had written a should of term queries.

• Matching is per term, not per field value. On a keyword field the term is the whole value, so the prefix must match the value’s beginning. On a text field each analyzed token counts separately — web- matches the token web-01 wherever the analyzer left it intact.
• No analysis runs on the prefix itself. It is compared verbatim against the stored terms; on text fields analyzed with standard, stored tokens are lowercase, so a capitalized prefix (Web-) finds nothing unless case_insensitive folds it.
• Scoring. The expansion rewrites to constant_score: every matching document scores exactly boost (default 1), on the realtime buffer and on frozen segments alike. In a bool.filter context the scores are simply discarded.
• rewrite is accepted on the wire (constant_score by default, plus the scoring_boolean / top_terms_N family) for body compatibility; the engine currently scores expansions as described above regardless of the setting.

Examples #

Every host in the logs dataset is one of web-01, web-02, web-03 — so the web- prefix below matches all 150 documents.

GET /_search
{
  "query": {
    "prefix": {
      "field": "org.id",
      "value": "inf"
    }
  }
}

Use cases #

• Hostname / shard families. host: "web-" over the logs dataset (all 150 lines) — the classic fleet-scoping filter, cheaper than a terms list because you need not enumerate the hosts.
• URL sections. url.path: "/api" matches the 50 lines whose path is /api/v1/products or /api/v1/orders.
• ID schemes. Key spaces like L00… or order numbers with a fixed date prefix (2024-06-…) slice by construction, without ranges.
• Typeahead on keyword fields. For exact-vocabulary completion over keyword terms; for analyzed free text prefer the match family, which analyzes the input the same way the field was indexed.

Parameters for prefix #

• field
  (Required, string) Field you wish to search.
• value
  (Required, string) Beginning characters of terms you wish to find in the provided field.
• case_insensitive
  (Optional, boolean) Allows ASCII case insensitive matching of the value with the indexed field values when set to true. Default is false.
• boost
  (Optional, float, default: 1.0) Decrease or increase the relevance scores of the query.
• rewrite
  (Optional, string) Method used to rewrite the expanded terms (constant_score, scoring_boolean, top_terms_N, …).

Related #

• wildcard — patterns anywhere in the term, not just the head.
• suffix — the mirror image; matches term endings.
• regexp — the fully general pattern over dictionary terms.
• term — the atom every expansion eventually resolves to.
• intervals — a prefix rule also exists inside interval queries for positional matching.