diff --git a/servers/slapd/back-bdb2/filterindex.c b/servers/slapd/back-bdb2/filterindex.c
index 12d88d46c8..1136661e44 100644
--- a/servers/slapd/back-bdb2/filterindex.c
+++ b/servers/slapd/back-bdb2/filterindex.c
@@ -361,6 +361,14 @@ substring_comp_candidates(
 		if( idl == NULL ) {
 			break;
 		}
+
+		/* if we're down to two (or less) matches, stop searching */
+		if( ID_BLOCK_NIDS(idl) < 3 ) {
+			Debug( LDAP_DEBUG_TRACE, "substring_comp_candidates: "
+				"down to a %ld matches, stopped search\n",
+					(long) ID_BLOCK_NIDS(idl), 0, 0 );
+			break;
+		}
 	}
 
 	Debug( LDAP_DEBUG_TRACE, "<= substring_comp_candidates %ld\n",
diff --git a/servers/slapd/back-ldbm/filterindex.c b/servers/slapd/back-ldbm/filterindex.c
index 1cf5563a40..97b2c87866 100644
--- a/servers/slapd/back-ldbm/filterindex.c
+++ b/servers/slapd/back-ldbm/filterindex.c
@@ -365,6 +365,14 @@ substring_comp_candidates(
 		if( idl == NULL ) {
 			break;
 		}
+
+		/* if we're down to two (or less) matches, stop searching */
+		if( ID_BLOCK_NIDS(idl) < 3 ) {
+			Debug( LDAP_DEBUG_TRACE, "substring_comp_candiates: "
+				"down to a %ld matches, stopped search\n",
+					(long) ID_BLOCK_NIDS(idl), 0, 0 );
+			break;
+		}
 	}
 
 	Debug( LDAP_DEBUG_TRACE, "<= substring_comp_candidates %ld\n",