Scribd
Upload
18 views

Elasticsearch query string syntax Cheat Sheet

Uploaded by

Andriy Bilokin
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
18 views

Elasticsearch query string syntax Cheat Sheet

Uploaded by

Andriy Bilokin
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 1

Elasticsearch query string syntax Cheat Sheet

Field names Fuzziness

where "status" field contains "active" search for terms that are similar to, but not exactly like
status:active the used search terms, using the "fuzzy"' operator
quikc~ brwn~ foks~
"title" field contains "quick" or "brown". If you omit
the OR operator the default operator will be used The default edit distance is 2, but an edit distance of 1
title:(quick OR brown) should be sufficient to catch 80% of all human
title:(quick brown)
misspellings.
It can be specified as
where "author" field contains the exact phrase "john quikc~1
smith" Proximity searches
author:"John Smith"

While a phrase query (eg "john smith") expects all of


where any of the fields "book.title", "book.content" or
the terms in exactly the same order, a proximity query
"book.date" contains quick or brown (note how we
allows the specified words to be further apart or in a
need to escape the "*" with a backslash
book.*:(quick brown) different order. A proximity search allows us to
specify a maximum edit distance of words in a phrase:
"fox quick"~5
where the field "title" has no value (or is missing):
_missing_:title Ranges

where the field "title" has any non-null value: Ranges can be specified for date, numeric or string
_exists_:title fields. Inclusive ranges are specified with square
Wildcards brackets [min TO max] and exclusive ranges with
curly brackets {min TO max}.
Wildcard searches can be run on individual terms, All days in 2012
using "?" to replace a single character, and "*" to date:[2012-01-01 TO 2012-12-31]
replace zero or more characters
qu?ck bro* Numbers 1..5
note: wildcard queries can use an enormous amount count:[1 TO 5]
of memory and perform very badly
Tags between alpha and omega, excluding alpha and
omega
Regular expressions tag:{alpha TO omega}

Regular expression patterns can be embedded in the Numbers from 10 upwards


query string by wrapping them in forward-slashes ("/") count:[10 TO *]
name:/joh?n(ath[oa]n)/
Grouping Dates before 2012
date:{* TO 2012-01-01}
Multiple terms or clauses can be grouped together
with parentheses, to form sub-queries: Numbers from 1 up to but not including 5
(quick OR brown) AND fox count:[1 TO 5}
Groups can be used to target a particular field, or to Boolean operators
boost the result of a sub-query:
status:(active OR pending) title:(full text
+ (this term must be present) and - (this term must not
search)^2
be present)
All other terms are optional
quick brown +fox -news

You might also like