Suffix query #

Returns documents that contain terms ending in the provided value. This is the mirror of the prefix query; like a leading wildcard, it is more expensive than a prefix match.

Inside a nested query: not supported yet — the clause is rejected with an HTTP 400 naming the offending clause.

How it works #

A term dictionary is sorted by its beginnings, so a prefix can seek directly to its subtree — but a suffix cannot. The engine therefore walks the whole dictionary of the field and keeps the terms that end with the value, then unions their postings lists exactly like a should of term queries. The cost is proportional to the number of distinct terms in the field, not to the number of matches, which is why the suffix query is marked more expensive than prefix.

• Matching is per term. On a keyword field the term is the whole value (url.path = "/app.js" ends with .js); on a text field each analyzed token is tested separately.
• No analysis runs on the suffix itself — it is compared verbatim against stored terms. On fields analyzed with standard, stored tokens are lowercase.
• Scoring. The expansion rewrites to constant_score: every matching document scores exactly boost (default 1); inside a bool.filter the scores are discarded, leaving a pure set filter.
• rewrite is accepted on the wire for body compatibility (constant_score default); the engine scores expansions as described above regardless of the setting.

Examples #

The following search returns the /app.js requests — the 25 documents whose url.path ends in .js.

The SQL twin quotes the dotted name ("url.path") — the dot would otherwise parse as part of an expression.

POST /my-collection/_search
{
  "query": {
    "suffix": {
      "field": "url.path",
      "value": ".jpg"
    }
  }
}

Use cases #

• File extensions. .js, .jpg, .png over url.path (keyword) — the canonical suffix query; the logs dataset answers 25 for .js, 25 for .jpg.
• Domain TLDs. host/referrer values ending in .cn, .io, .com group infrastructure by registry without a wildcard.
• Naming conventions. Environment suffixes (-prod, -staging), generated ID tails (…-v2) — anything where the meaning lives at the end of the string.
• Slug routing. Doc slugs ending in -guide / -reference when the head varies too much to enumerate.

Parameters for suffix #

• field
  (Required, string) Field you wish to search.
• value
  (Required, string) The suffix terms must end with.
• case_insensitive
  (Optional, boolean, default: false) ASCII case-insensitive matching of the value with the indexed field values.
• rewrite
  (Optional, string) Method used to rewrite the query (constant_score, scoring_boolean, …).
• boost
  (Optional, float, default: 1) Score multiplier — with the constant-score rewrite every matching document scores exactly boost.

Related #

• prefix — the cheap mirror; seeks in the sorted dictionary instead of scanning it.
• wildcard — *foo is the same leading-anchor idea with more pattern power (and the same cost profile).
• regexp — suffix anchored patterns like .*\.js as a full regular expression.
• term — the atom every expansion resolves to.