The term query is one of the simplest queries in Elasticsearch. It just matches the document that has a term in a given field - the exact, not analyzed term. The simplest term query is as follows:

{
  "query" : {
  "term" : {
    "title" : "crime"
  }
  }
}

It will match the documents that have the term crime in the title field. Remember that the term query is not analyzed, so you need to provide the exact term that will match the term in the indexed document. Note that in our input data, we have the title field with the value of Crime and Punishment (upper cased), but we are searching for crime, because the Crime terms becomes crime after analysis during indexing.

In addition to the term we want to find, we can also include the boost attribute to our term query, which will affect the importance of the given term. We will talk more about boosts in the Introduction to Apache Lucene scoring section of Chapter 6, Make Your Search Better. For now, we just need to remember that it changes the importance of the given part of the query.

For example, to change our previous query and give our term query a boost of 10.0, send the following query:

{
  "query" : {
  "term" : {
    "title" : {
    "value" : "crime",
    "boost" : 10.0
    }
  }
  }
}

As you can see, the query changed a bit. Instead of a simple term value, we nested a new JSON object which contains the value property and the boost property. The value of the value property should contain the term we are interested in and the boost property is the boost value we want to use.

The terms query is an extension to the term query. It allows us to match documents that have certain terms in their contents instead of a single term. The term query allowed us to match a single, not analyzed term and the terms query allows us to match multiple of those. For example, let's say that we want to get all the documents that have the terms novel or book in the tags field. To achieve this, we will run the following query:

{
  "query" : {
  "terms" : {
    "tags" : [ "novel", "book" ]
  }
  }
}

The preceding query returns all the documents that have one or both of the searched terms in the tags field. This is a key point to remember – the terms query will find documents having any of the provided terms.

The match all query is one of the simplest queries available in Elasticsearch. It allows us to match all of the documents in the index. If we want to get all the documents from our index, we just run the following query:

{
  "query" : {
  "match_all" : {}
  }
}

We can also include boost in the query, which will be given to all the documents matched by it. For example, if we want to add a boost of 2.0 to all the documents in our match all query, we will send the following query to Elasticsearch:

{
  "query" : {
  "match_all" : { 
    "boost" : 2.0 
  }
  }
}

A very simple query that allows us to find all the documents with a certain type. For example, if we would like to search for all the documents with the book type in our library index, we will run the following query:

{
  "query" : {
  "type" : {
    "value" : "book"
  }
  }
}

A query that allows us to find all the documents that have a value in the defined field. For example, to find the documents that have a value in the tags field, we will run the following query:

{
  "query" : {
  "exists" : {
    "field" : "tags"
  }
  }
}

Opposite to the exists query, the missing query returns the documents that have a null value or no value at all in a given field. For example, to find all the documents that don't have a value in the tags field, we will run the following query:

{
  "query" : {
  "missing" : {
    "field" : "tags"
  }
  }
}

The common terms query is a modern Elasticsearch solution for improving query relevance and precision with common words when we are not using stop words (http://en.wikipedia.org/wiki/Stop_words). For example, a crime and punishment query results in three term queries and each of them have a cost in terms of performance. However, the and term is a very common one and its impact on the document score will be very low. The solution is the common terms query which divides the query into two groups. The first group is the one with important terms, which are the ones that have lower frequency. The second group is the one with less important terms, which are the ones with high frequency. The first query is executed first and Elasticsearch calculates the score for all of the terms from the first group. This way the low frequency terms, which are usually the ones that have more importance, are always taken into consideration. Then Elasticsearch executes the second query for the second group of terms, but calculates the score only for the documents matched for the first query. This way the score is only calculated for the relevant documents and thus higher performance can be achieved.

An example of the common terms query is as follows:

{
 "query" : {
  "common" : { 
   "title" : {
    "query" : "crime and punishment",
    "cutoff_frequency" : 0.001
   }
  }
 }
}

The query can take the following parameters:

The match query takes the values given in the query parameter, analyzes it, and constructs the appropriate query out of it. When using a match query, Elasticsearch will choose the proper analyzer for the field we choose, so you can be sure that the terms passed to the match query will be processed by the same analyzer that was used during indexing. Remember that the match query (and the multi_match query) doesn't support Lucene query syntax; however, it perfectly fits as a query handler for your search box. The simplest match (and the default) query will look like the following:

{
  "query" : {
    "match" : {
      "title" : "crime and punishment"
    }
  }
}

The preceding query will match all the documents that have the terms crime, and, or punishment in the title field. However, the previous query is only the simplest one; there are multiple types of match query which we will discuss now.

{
  "query" : {
  "match" : {
    "title" : {
    "query" : "crime and punishment",
    "operator" : "and"
    }
  }
  }
}

{
  "query" : {
  "match_phrase" : {
    "title" : {
    "query" : "crime punishment",
    "slop" : 1
    }
  }
  }
}

{
  "query" : {
  "match_phrase_prefix" : {
    "title" : {
    "query" : "crime punishm",
    "slop" : 1,
    "max_expansions" : 20
    }
  }
  }
}

It is the same as the match query, but instead of running against a single field, it can be run against multiple fields with the use of the fields parameter. Of course, all the parameters you use with the match query can be used with the multi match query. So if we would like to modify our match query to be run against the title and otitle fields, we will run the following query:

{
  "query" : {
    "multi_match" : {
      "query" : "crime punishment",
      "fields" : [ "title^10", "otitle" ]
  }
  }
}

As shown in the preceding example, the nice thing about the multi match query is that the fields defined in it support boosting, so we can increase or decrease the importance of matches on certain fields.

However, this is not the only difference when it comes to comparison with the match query. We can also control how the query is run internally by using the type property and setting it to one of the following values:

In addition to the parameters mentioned in the match query and type, the multi match query exposes some additional ones allowing more control over its behavior:

In comparison to the other queries available, the query string query supports full Apache Lucene query syntax, which we discussed earlier in the Lucene query syntax section of Chapter 1, Getting Started with Elasticsearch Cluster. It uses a query parser to construct an actual query using the provided text. An example query string query will look like the following code:

{
  "query" : {
  "query_string" : {
    "query" : "title:crime^10 +title:punishment -otitle:cat +author:(+Fyodor +dostoevsky)",
    "default_field" : "title"
  }
  }
}

Because we are familiar with the basics of the Lucene query syntax, we can discuss how the preceding query works. As you can see, we wanted to get the documents that may have the term crime in the title field and such documents should be boosted with the value of 10. Next, we wanted only the documents that have the term punishment in the title field and we didn't want documents with the term cat in the otitle field. Finally, we told Lucene that we only wanted the documents that had the fyodor and dostoevsky terms in the author field.

Similar to most of the queries in Elasticsearch, the query string query provides quite a few parameters that allow us to control the query behavior and the list of parameters for this query is rather extensive:

Note that Elasticsearch can rewrite the query string query and, because of that, Elasticsearch allows us to pass additional parameters that control the rewrite method. However, for more details about this process, go to the Understanding the querying process section in this chapter.

{
 "query" : {
  "query_string" : {
   "query" : "crime punishment",
   "fields" : [ "title", "otitle" ],
   "use_dis_max" : true
  }
 }
}

The simple query string query uses one of the newest query parsers in Lucene - the SimpleQueryParser (https://lucene.apache.org/core/5_4_0/queryparser/org/apache/lucene/queryparser/simple/SimpleQueryParser.html). Similar to the query string query, it accepts Lucene query syntax as the query; however, unlike it, it never throws an exception when a parsing error happens. Instead of throwing an exception, it discards the invalid parts of the query and runs the rest.

An example simple query string query will look like the following code:

{
 "query" : {
  "simple_query_string" : {
   "query" : "crime punishment",
   "default_operator" : "or"
  }
 }
}

The query supports parameters such as query, fields, default_operator, analyzer, lowercase_expanded_terms, locale, lenient, and minimum_should_match, and can also be run against multiple fields using the fields property.

This is a simple query that filters the returned documents to only those with the provided identifiers. It works on the internal _uid field, so it doesn't require the _id field to be enabled. The simplest version of such a query will look like the following:

{
  "query" : {
  "ids" : {
   "values" : [ "1", "2", "3" ]
  }
  }
}

This query will only return those documents that have one of the identifiers present in the values array. We can complicate the identifiers query a bit and also limit the documents on the basis of their type. For example, if we want to only include documents from the book types, we will send the following query:

{
 "query" : {
  "ids" : {
   "type" : "book",
   "values" : [ "1", "2", "3" ]
  }
 }
}

As you can see, we've added the type property to our query and we've set its value to the type we are interested in.

This query is similar to the term query in its configuration and to the multi term query when looking into its logic. The prefix query allows us to match documents that have the value in a certain field that starts with a given prefix. For example, if we want to find all the documents that have values starting with cri in the title field, we will run the following query:

{
  "query" : {
    "prefix" : {
      "title" : "cri"
    }
  }
}

Similar to the term query, you can also include the boost attribute to your prefix query which will affect the importance of the given prefix. For example, if we would like to change our previous query and give our query a boost of 3.0, we will send the following query:

{
  "query" : {
  "prefix" : {
    "title" : {
    "value" : "cri",
    "boost" : 3.0
    }
  }
  }
}

The fuzzy query allows us to find documents that have values similar to the ones we've provided in the query. The similarity of terms is calculated on the basis of the edit distance algorithm. The edit distance is calculated on the basis of terms we provide in the query and against the searched documents. This query can be expensive when it comes to CPU resources, but can help us when we need fuzzy matching; for example, when users make spelling mistakes. In our example, let's assume that instead of crime, our user enters the crme word into the search box and we would like to run the simplest form of fuzzy query. Such a query will look like this:

{
  "query" : {
    "fuzzy" : {
      "title" : "crme"
    }
  }
}

The response for such a query will be as follows:

{
  "took" : 81,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 0.5,
    "hits" : [ {
      "_index" : "library",
      "_type" : "book",
      "_id" : "4",
      "_score" : 0.5,
      "_source" : {
        "title" : "Crime and Punishment",
        "otitle" : "Преступлéние и наказáние",
        "author" : "Fyodor Dostoevsky",
        "year" : 1886,
        "characters" : [ "Raskolnikov", "Sofia Semyonovna Marmeladova" ],
        "tags" : [ ],
        "copies" : 0,
        "available" : true
      }
    } ]
  }
}

Even though we made a typo, Elasticsearch managed to find the documents we were interested in.

We can control the fuzzy query behavior by using the following parameters:

The parameters should be wrapped in the name of the field we are running the query against. So if we would like to modify the previous query and add additional parameters, the query will look like the following code:

{
 "query" : {
  "fuzzy" : {
   "title" : {
    "value" : "crme",
    "fuzziness" : 2
   }
  }
 }
}

A query that allows us to use * and ? wildcards in the values we search. Apart from that, the wildcard query is very similar to the term query in case of its body. To send a query that would match all the documents with the value of the cr?me term (? matching any character) we would send the following query:

{
 "query" : {
  "wildcard" : {
   "title" : "cr?me"
  }
 }
}

It will match the documents that have all the terms matching cr?me in the title field. However, you can also include the boost attribute to your wildcard query which will affect the importance of each term that matches the given value. For example, if we would like to change our previous query and give our term query a boost of 20.0, we will send the following query:

{
 "query" : {
  "wildcard" : {
   "title" : {
    "value" : "cr?me",
    "boost" : 20.0
   }
  }
 }
}

A query that allows us to find documents that have a field value within a certain range and which works for numerical fields as well as for string-based fields and date based fields (just maps to a different Apache Lucene query). The range query should be run against a single field and the query parameters should be wrapped in the field name. The following parameters are supported:

So for example, if we want to find all the books that have the value from 1700 to 1900 in the year field, we will run the following query:

{
 "query" : {
  "range" : {
   "year" : {
    "gte" : 1700,
    "lte" : 1900
   }
  }
 }
}

Regular expression query allows us to use regular expressions as the query text. Remember that the performance of such queries depends on the chosen regular expression. If our regular expression would match many terms, the query will be slow. The general rule is that the more terms matched by the regular expression, the slower the query will be.

An example regular expression query looks like this:

{
 "query" : {
  "regexp" : {
   "title" : {
    "value" : "cr.m[ae]",
    "boost" : 10.0
   }
  }
 }
}

The preceding query will result in Elasticsearch rewriting the query. The rewritten query will have the number of term queries depending on the content of our index matching the given regular expression. The boost parameter seen in the query specifies the boost value for the generated queries.

The full regular expression syntax accepted by Elasticsearch can be found at https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-regexp-query.html#regexp-syntax.

One of the queries that got a major rework in Elasticsearch 2.0, the more like this query allows us to retrieve documents that are similar (or not similar) to the provided text or to the documents that were provided.

The more like this query allows us to get documents that are similar to the provided text. Elasticsearch supports a few parameters to define how the more like this query should work:

An example for a more like this query looks like this:

{
 "query" : {
  "more_like_this" : {
   "fields" : [ "title", "otitle" ],
   "like" : "crime and punishment",
   "min_term_freq" : 1,
   "min_doc_freq" : 1
  }
 }
}

As we said earlier, the like property can also be used to show which documents the results should be similar to. For example, the following is the query that will use the like property to point to a given document (note that the following query won't return documents on our example data):

{
  "query" : {
  "more_like_this" : {
    "fields" : [ "title", "otitle" ],
    "min_term_freq" : 1,
    "min_doc_freq" : 1,
    "like" : [
     {
      "_index" : "library",
      "_type" : "book",
      "_id" : "4"
    }
    ]
  }
  }
}

We can also mix the documents and text together:

{
  "query" : {
  "more_like_this" : {
    "fields" : [ "title", "otitle" ],
    "min_term_freq" : 1,
    "min_doc_freq" : 1,
    "like" : [
    {
      "_index" : "library",
      "_type" : "book",
      "_id" : "4"
    },
    "crime and punishment"
    ]
  }
  }
}