Query DSL

A match query runs the string through the field's search analyzer, turning it into terms, then builds a boolean query over those terms. By default a document matching any single term is a hit.

Because from + size exceeds index.max_result_window, which defaults to 10,000. Deep paging makes every shard build a top-(from+size) list that the coordinating node merges and then throws almost all of away, so Elasticsearch caps the depth instead.

A term query looks up the exact bytes you supply with no analysis, while a text field stores analyzed tokens that are split and lowercased. Searching for New York finds no such token. Use match, or a keyword sub-field.

Only when minimum_should_match requires it. If the bool query has at least one should clause and no must or filter clauses, minimum_should_match defaults to 1; otherwise it defaults to 0, so should clauses only add to _score.

Mapping a field as nested indexes each object in the array as its own hidden Lucene document, stored in one block with its parent. A nested query with a path then requires all clauses to match the same inner object.

By default Elasticsearch flattens an array of objects into independent multi-valued fields, losing which value belonged to which entry. A query for name alice and age 25 then matches even when those values came from different entries.

Open a point in time, sort by a field plus a unique tiebreaker, then send each next page with search_after set to the previous page's last hit sort array. Cost per page stays constant, and the PIT keeps pages consistent while indexing continues.

Date math takes an anchor (now, or a date followed by two pipes), applies offsets such as minus seven days, then optionally rounds with a slash plus a unit. Rounding direction depends on which endpoint uses it.

best_fields takes the best-scoring single field, so all query terms should be in one field. most_fields sums the scores of several analyses of the same text. cross_fields is term-centric: it treats the listed fields as one big field so terms may be spread across them.

The exists query matches documents that have an indexed value for a field. A JSON null, an empty array, and an array of only nulls all count as missing, as do values skipped by ignore_above or ignore_malformed.

constant_score runs its inner query in filter context and gives every matching document the same score, taken from its boost parameter, which defaults to 1.0. Matching is unchanged; the inner query's own relevance calculation is discarded.

dis_max scores a document by its single best-matching sub-query. tie_breaker, default 0.0, adds that fraction of every other matching sub-query's score to the total, so documents matching several clauses edge ahead of equally-good single-clause matches.

fuzziness allows each analyzed term to match index terms within an edit distance, capped at 2 edits. AUTO scales with term length: no edits for terms of 1-2 characters, one edit for 3-5, two edits above that.

match_phrase requires all analyzed terms in the same field, in the given order, at consecutive positions. slop is the number of position moves allowed, so a non-zero slop tolerates intervening words and, at a cost of two moves, reversed pairs.

Both control how many of the analyzed terms a document must contain. operator switches between any term (or) and every term (and); minimum_should_match sets a count or percentage in between, trading recall for precision.

inner_hits attaches to each matching document the specific nested or child documents that caused the match, with their own source, scores, sorting and highlighting. Without it the hit's _source contains every child and you cannot tell which one matched.

A join field declares parent-child relations inside one index. Children are independent documents that must be routed to their parent's shard; has_child returns parents whose children match, and has_parent returns children whose parent matches.

Sorting needs one value per document read from a columnar doc_values structure, and analyzed text fields have doc_values disabled, so the request errors telling you fielddata is off. Sort on a keyword sub-field such as title.keyword, which has doc_values by default.

Elasticsearch stops counting matches accurately at 10,000 by default so top-k queries can skip non-competitive documents. A relation of gte means at least that many matched. track_total_hits: true forces an exact count, false skips counting entirely, and an integer sets a different threshold.

AUTO scales the allowed edit distance with term length: no edits for very short terms, one edit for medium ones, two for longer ones. Edit distance counts insertions, deletions, substitutions, and by default transpositions.

Use terms_lookup when the list of values already lives in another document — a user's group memberships or blocked ids — so Elasticsearch fetches it server-side instead of your application shipping thousands of values in every request.

Only clauses running in filter context — the filter and must_not slots, plus anything inside constant_score. The cache stores per-segment doc-id sets for those clauses, so a repeated filter is answered from a bitset instead of re-executed. Scored clauses are never cached this way.

Prefer simple_query_string for anything user-facing: it never fails on bad syntax and its operator set can be restricted. Reserve query_string, which parses full Lucene syntax and returns an error on malformed input, for trusted power users.

Every nested object becomes its own Lucene document, so a document with 200 entries indexes as 201. Any update rewrites the whole block, deleting and re-adding every child, and dedicated limits cap nested fields per index and nested objects per document.

Almost never for new code. Scroll is a stateful snapshot cursor built for exporting an entire result set once, and Elasticsearch no longer recommends it for deep pagination; search_after with a point in time covers the same ground statelessly. Scroll survives mainly in existing batch jobs.

That cost is the fetch phase reading and decompressing _source for every returned hit. Return fewer hits per page, use _source filtering to shrink the payload, read small values from doc_values with docvalue_fields, or map the few needed fields with store true so _source is never touched.

A leading wildcard gives no fixed prefix, so Elasticsearch must walk every term in that field's dictionary and test each one. The fix is index-time: index_prefixes, an edge n-gram or reversed field, or the wildcard field type.

Start from denormalization: one document per entity you want to return. Add nested only when the many-side is small, bounded and updated with its parent. Use a join field only when children churn far more often than parents and query volume can absorb it.

must_not removes matching documents from the result set entirely. The boosting query keeps them: documents matching its positive query are returned, and those also matching its negative query have their score multiplied by negative_boost, so they sink rather than disappear.