The term query is one of the simplest queries in ElasticSearch and just matches any document that has a term in a given field. You are familiar with this query type because we used it already, but just to have all the query types in one place. The simplest term query is as follows:

{
 "query" : {
  "term" : {
   "title" : "crime"
  }
 }
}

It will match the documents that have the term "crime" in the title field. Please remember that the term query is not analyzed, so you need to provide the exact term that will match the term in the indexed document. However, you can also include the boost attribute in your term query; this will affect the importance of the given term. For example, if we wanted to change our previous query and give our term query a boost of 10.0, we would send the following query:

{
 "query" : {
  "term" : {
   "title" : {
    "value" : "crime",
    "boost" : 10.0
   }
  }
 }
}

As you can see, the query changes a bit. Instead of a simple term value we nest a new JSON object, which contains the value property and the boost property. The value of the value property should contain the term we are interested in and the boost property is the boost value we want to use.

This is a query that allows us to match documents that have certain terms in their contents. For example, let's say that we want to get all the documents that have the terms "novel" or "book" in the tags field. To achieve that, we could run the following query:

{
 "query" : {
  "terms" : {
   "tags" : [ "novel", "book" ],
   "minimum_match" : 1
  }
 }
}

The preceding query returns all the documents that have one or both of the searched terms in the tags field. Why is that? Because we set the minimum_match property to 1, which basically means that one term should be matched. If we wanted the query to match only a document with both the provided terms, we would set the minimum_match propert to 2.

The match query takes the values given in the query parameter, analyzes them, and constructs the appropriate query out of them. When using a match query, ElasticSearch will choose the proper analyzer for a field we've chosen, so you can be sure that the terms passed to the match query will be processed by the same analyzer that was used during indexing. Please remember that the match query (and as further explained, the multi match query) doesn't support Lucene query syntax (discussed in the The query string query section, later in this chapter); however, it fits perfectly as a query handler for your search box. The simplest (and the default) match query can look like this:

{
 "query" : {
  "match" : {
   "title" : "crime and punishment"
  }
 }
}

The preceding query would match all the documents that have the terms "crime" or "and" or "punishment" in the title field. However, the preceding query is only the simplest one; there are multiple types of match query. They are covered in the following sections.

{
 "query" : {
  "match_phrase" : {
   "title" : {
    "query" : "crime and punishment",
    "slop" : 1
   }
  }
 }
}

{
 "query" : {
  "match_phrase_prefix" : {
   "title" : {
    "query" : "crime and punishment",
    "slop" : 1,
    "max_expansions" : 20
   }
  }
 }
}

This is the same as the match query, but instead of running against a single field, it can be run against multiple fields with the use of the fields parameter. Of course, all the parameters you use with the match query can be used with the multi match query. So, if we want to modify our match query to be run against the title and otitle fields, we could run the following query:

{
 "query" : {
  "multi_match" : {
   "query" : "crime punishment",
   "fields" : [ "title", "otitle" ]
  }
 }
}

In comparison with the other queries available , the query string query supports full Apache Lucene query syntax, so it uses a query parser to construct an actual query using the provided text. A sample query string query can look like this:

{
 "query" : {
  "query_string" : {
   "query" : "title:crime^10 +title:punishment -otitle:cat +author:(+Fyodor +dostoevsky)",
   "default_field" : "title"
  }
 }
}

You may wonder what that weird syntax in the query parameter is; we will get to it in the Lucene query syntax part of the query string query description.

As with most of the queries in ElasticSearch, the query string query provides a few parameters that allow us to control query behavior:

Please note that the query string query can be rewritten by ElasticSearch, and because of that, ElasticSearch allows us to pass additional parameters that control the rewrite method. However, for more details about that process, see the Query rewrite section later in this chapter.

title:book

title:"elasticsearch book"

+title:book -description:cat

title:(crime punishment)

title:book^4

{
 "query" : {
  "query_string" : {
   "query" : "crime punishment",
   "fields" : [ "title", "otitle" ],
   "use_dis_max" : true
  }
 }
}

The field query is a simplified version of the query string query that we just discussed. I would only like to find all the documents that have the term "crime" in the title field, that may have the term "nothing" and that don't have the term "let" in the same field. For that, we could run the following query:

{
 "query" : {
  "field" : {
   "title" : "+crime nothing -let"
  }
 }
}

You can also apply all the properties that apply to the query string query. To do that, we should wrap all the parameters in the field name and pass the actual query in the query parameter. So, the preceding query with the boost parameter added would look like this:

{
 "query" : {
  "field" : {
   "title" : {
    "query" : "+crime nothing -let",
    "boost" : 20.0
   }
  }
 }
}

This is a simple query that filters the returned documents to only those with the provided identifiers. It works on the internal _uid field, so it doesn't require the _id field to be enabled. The simplest version of such a query could look like the following query:

{
 "query" : {
  "ids" : {
   "values" : [ "10", "11", "12", "13" ]
  }
 }
}

This query would only return documents that have one of the identifiers present in the values array. We can complicate the identifiers query a bit and also limit the documents on the basis of their type. For example, if we want to only include documents from the book type, we could send the following query:

{
 "query" : {
  "ids" : {
   "type" : "book",
   "values" : [ "10", "11", "12", "13" ]
  }
 }
}

The prefix query is similar to the term query in terms of configuration and to the multi term query when looking into its logic. The prefix query allows us to match documents that have a value in a certain field that starts with a given prefix. For example, if we want to find all the documents that have values starting with cri in the title field, we could run the following query:

{
 "query" : {
  "prefix" : {
   "title" : "cri"
  }
 }
}

As with the term query, you can also include the boost attribute with your prefix query; this will affect the importance of the given prefix. For example, if we wanted to change our previous query and give it a boost of 3.0, we would send the following query:

{
 "query" : {
  "prefix" : {
   "title" : {
    "value" : "cri",
    "boost" : 3.0
   }
  }
 }
}

The fuzzy like this query is similar to the more like this query. It finds all the documents that are similar to the provided text but works a bit differently from the more like this query because it makes use of fuzzy strings and picks the best differencing terms produced. For example, if we want to run a fuzzy like this query against the title and otitle fields and find all the documents similar to the crime punishment query, we could run the following query:

{
 "query" : {
  "fuzzy_like_this" : {
   "fields" : ["title", "otitle"],
   "like_text" : "crime punishment"
  }
 }
}

The following query parameters are supported:

The fuzzy like this field query is similar to the fuzzy like this query but works only against a single field, and because of that, it doesn't support the fields property. Instead of specifying the fields that should be used for query analysis, we should wrap the query parameters into the field name. Our sample query to a title field should look like the following code:

{
 "query" : {
  "fuzzy_like_this_field" : {
   "title" : {
    "like_text" : "crime and punishment"
   }
  }
 }
}

All the other parameters from the fuzzy like this query work the same for this type of query.

The third type of fuzzy query matches documents on the basis of the edit distance algorithm that is calculated on the terms we provide against the searched documents. This query can be expensive when it comes to CPU resources but can help us when we need fuzzy matching, for example, when users make spelling mistakes. In our example, let's assume that, instead of crime, our user enters cirme into the search box and we would like to run the simplest form of fuzzy query. Such a query could look like this:

{
 "query" : {
  "fuzzy" : {
   "title" : "cirme"
  }
 }
}

And the response for this query would be as follows:

{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 1,
    "max_score" : 0.625,
    "hits" : [ {
      "_index" : "library",
      "_type" : "book",
      "_id" : "4",
      "_score" : 0.625, "_source" : { "title": "Crime and Punishment","otitle": "Преступлéние и наказáние","author": "Fyodor Dostoevsky","year": 1886,"characters": ["Raskolnikov", "Sofia Semyonovna Marmeladova"],"tags": [],"copies": 0, "available" : true}
    } ]
  }
}

As you can see, even though we made a typo, ElasticSearch managed to find the document we were interested in.

You can control the fuzzy query behavior by using the following parameters:

The parameters should be wrapped in the name of the field we are running the query against. So, if we would like to modify the previous query and add additional parameters, the query could look like the following code:

{
 "query" : {
  "fuzzy" : {
   "title" : {
    "value" : "cirme",
    "min_similarity" : 0.2
   }
  }
 }
}

The match all query is a simple query that matches all documents in the index. So, to match all the documents, we would run the following query:

{
 "query" : {
  "match_all" : {}
 }
}

If we want to use index-time boosting for some field and want the match all query to take the index-time boosts into consideration during query execution, we can add the norms_field property with the value of the boosted field. For example, if we boost the title field during indexing and want the match all query to influence the score of the documents with it, the following query will have to be run:

{
 "query" : {
  "match_all" : {
   "norms_field" : "title"
  }
 }
}

The wildcard query is a query that allows us to use the * and ? wildcards in the values we search for. Apart from that, the wildcard query is very similar to the term query in its body. To send a query that will match all the documents with the value of the term cr?me, with ? meaning any character, we will use:

{
 "query" : {
  "wildcard" : {
   "title" : "cr?me"
  }
 }
}

It will match the documents that have any of the terms matching cr?me in the title field. However, you can also include the boost attribute with your wildcard query, which will affect the importance of each term that matches the given value. For example, if we want to change our previous query and give our term query a boost of 20.0, we will send the following query:

{
 "query" : {
  "wildcard" : {
   "title" : {
    "value" : "cr?me",
    "boost" : 20.0
   }
  }
 }
}

The more like this query allows us to get documents that are similar to the provided text. ElasticSearch support a few parameters to define how more like this queries should work:

An example more like this query could look like this:

{
 "query" : {
  "more_like_this" : {
   "fields" : [ "title", "otitle" ],
   "like_text" : "crime and punishment",
   "min_term_freq" : 1,
   "min_doc_freq" : 1
  }
 }
}

The more like this field query is similar to the more like this query but works only against a single field, and because of that, it doesn't support the fields property. Instead of specifying fields that should be used for query analysis, we should wrap query parameters into the field name. So, our example query to a title field would look like the following code:

{
 "query" : {
  "more_like_this_field" : {
   "title" : {
    "like_text" : "crime and punishment",
    "min_term_freq" : 1,
    "min_doc_freq" : 1
   }
  }
 }
}

All the other parameters from the more like this query work the same for this type of query.

This is a query that allows us to find documents within a certain range and works for numerical fields as well as for string-based fields (it just maps to a different Apache Lucene query). The range query should be run against a single field, and the query parameters should be wrapped in the field name. The following parameters are supported:

So, for example, if we would like to find all the books that have values ranging from 1700 to 1900 in the year field, we could run the following query:

{
 "query" : {
  "range" : {
   "year" : {
    "from" : 1700,
    "to" : 1900
   }
  }
 }
}

In some cases, ElasticSearch must rewrite your query into another query to allow efficient query execution. This happens, for example, with the prefix query; behind the scenes, ElasticSearch changes the prefix query to a logical disjunction of all possible tokens with this prefix. Because of the rewriting process, ElasticSearch will set a static score equal to the query boost for each of the documents returned by such queries, but we can change that.

In order to control query rewriting, we need to add the rewrite property to our query with one of the following values:

When the rewrite property is not set, it defaults to either constant_score_boolean or constant_score_filter depending on the query.

So our example prefix query with the rewrite property could look like the following code:

{
 "query" : {
  "prefix" : {
   "title" : {
    "value" : "cri",
    "boost" : 3.0,
    "rewrite" : "top_terms_10"
   }
  }
 }
}