Querying with Query DSL

1. Understanding Query Context vs Filter Context

Context	Description	Usage	Performance
Query Context	Used for scoring and relevance-based matching	Matches documents based on full-text search, term matching with scores	Slower due to scoring and relevance calculations
Filter Context	Used for filtering documents without scoring	Matches documents based on exact values or ranges, no relevance	Faster due to caching and optimized filtering

Example: Query Context Usage

{
  "query": {
    "match": {
      "title": "Elasticsearch"
    }
  }
}

Example: Filter Context Usage

{
  "query": {
    "term": {
      "status": "published"
    }
  }
}

Note: Query context is used when relevance scoring matters, while filter context is preferred for performance in boolean or exact matching scenarios.

2. Using Match Query

Property	Description	Values
query	The text to search for	`string`
analyzer	Analyzer to use for text analysis	`string`
boost	Boost factor for relevance scoring	`float`
fuzziness	Maximum edit distance for fuzzy matching	`int`

Example: Basic Match Query

{
  "query": {
    "match": {
      "message": "this is a test"
    }
  }
}

Example: Match with Boost

{
  "query": {
    "match": {
      "message": {
        "query": "this is a test",
        "boost": 2.0
      }
    }
  }
}

Example: Fuzzy Match Query

{
  "query": {
    "match": {
      "message": {
        "query": "thsi is a test",
        "fuzziness": 2
      }
    }
  }
}

3. Using Match Phrase Query

Property	Description	Example
match_phrase	Matches documents containing a specific phrase in the exact order and adjacent to each other.	`{ "match_phrase": { "message": "this is a test" } }`

Example: Match Phrase Query

{
  "query": {
    "match_phrase": {
      "message": "this is a test"
    }
  }
}

Note: The match_phrase query is case-sensitive and does not analyze the input text.

4. Using Term Query

Property	Description	Example
term	Matches documents containing the exact term in a field	`{ "term": { "status.keyword": "active" } }`
boost	Boosts the relevance score of matching documents	`{ "term": { "status.keyword": { "value": "active", "boost": 2.0 } } }`

Example: Term Query Usage

{
  "query": {
    "term": {
      "user.id": "kimchy"
    }
  }
}

Note: The term query is not analyzed and matches the exact term as stored in the index.

5. Using Terms Query

Property	Description	Values
terms	Matches documents that contain any of the specified terms in a field	`"terms": { "field_name": ["value1", "value2"] }`

Example: Terms Query

{
  "query": {
    "terms": {
      "status": ["active", "pending"]
    }
  }
}

Note: The terms query is optimized for exact matches and performs well with a small number of terms. For large term lists, consider using terms_set or bool queries.

6. Using Range Query

Property	Description	Values
range	Defines a range query for numeric, date, or text fields	`{ "field": { "gte": 10, "lte": 20 } }`

Example: Range Query on Numeric Field

{
  "query": {
    "range": {
      "age": {
        "gte": 25,
        "lte": 40
      }
    }
  }
}

Example: Range Query on Date Field

{
  "query": {
    "range": {
      "created_at": {
        "gte": "2023-01-01T00:00:00",
        "lt": "2024-01-01T00:00:00"
      }
    }
  }
}

Note: The gte and lte operators define inclusive ranges, while gt and lt define exclusive ranges.

7. Using Exists Query

Property	Description	Values
field	Name of the field to check for existence	`string`
boost	Boosts the relevance score of documents matching this query	`float`
query_name	Unique name for the query to be used in aggregations or when retrieving query details	`string`

Example: Basic Exists Query

{
  "query": {
    "exists": {
      "field": "email"
    }
  }
}

Example: Exists Query with Boost

{
  "query": {
    "exists": {
      "field": "phone",
      "boost": 2.0
    }
  }
}

Note: The exists query matches documents where the specified field has a non-null value. It does not consider missing fields or null values as matching.

8. Using Prefix Query

Property	Description	Example
prefix	Matches documents where a field value starts with the specified prefix	`{ "prefix": { "message": "error" } }`

Example: Prefix Query Usage

{
  "query": {
    "prefix": {
      "status": "err"
    }
  }
}

9. Using Wildcard Query

Property	Value	Description
wildcard	`{"field": "value"}`	Matches documents where the specified field contains a value matching the wildcard pattern

Example: Basic Wildcard Query

{
  "query": {
    "wildcard": {
      "user.name": "*john*"
    }
  }
}

Example: Wildcard Query with Case Sensitive

{
  "query": {
    "wildcard": {
      "user.name": {
        "value": "*JOHN*",
        "case_insensitive": false
      }
    }
  }
}

Note: Wildcard queries can be slow and resource-intensive, especially with leading wildcards like *value*. Use them sparingly and consider alternatives such as prefix or term queries for better performance.

10. Using Fuzzy Query

Property	Description	Example
fuzziness	Controls how fuzzy the match can be. Can be an integer or "AUTO".	`fuzziness: 2`
prefix_length	Number of initial characters that must match exactly.	`prefix_length: 3`
max_expansions	Maximum number of terms that the fuzzy query can expand to.	`max_expansions: 50`

Example: Fuzzy Query in Elasticsearch

{
  "query": {
    "fuzzy": {
      "title": {
        "value": "elsticsearch",
        "fuzziness": 2
      }
    }
  }
}

11. Using Regexp Query

Property	Description	Values	Notes
query.regexp.field	Field to match the regular expression against	`string`	Required field
query.regexp.value	Regular expression pattern to match	`string`	Must be a valid regex pattern
query.regexp.flags	Flags to modify regex behavior	`string`	Optional, e.g., `IGNORECASE`, `DOTALL`

Example: Basic Regexp Query

{
  "query": {
    "regexp": {
      "field_name": ".*pattern.*"
    }
  }
}

Example: Regexp Query with Flags

{
  "query": {
    "regexp": {
      "field_name": {
        "value": ".*pattern.*",
        "flags": "IGNORECASE"
      }
    }
  }
}

12. Using Multi-Match Query

The multi_match query in Elasticsearch allows you to search for a query string across multiple fields. It's particularly useful when you want to match the same query text against several fields with different boosting levels.

Property	Description	Values
query	The query string to search for	`string`
fields	Array of field names to search in	`array`
type	Specifies how to match the query string across fields	`best_fields`, `most_fields`, `cross_fields`, `phrase`, `phrase_prefix`
boost	Boosts the relevance score of this query	`float`

Example: Basic multi_match query

{
  "multi_match" : {
    "query" : "elasticsearch",
    "fields" : [ "title", "content" ]
  }
}

Example: Multi-match with type and boost

{
  "multi_match" : {
    "query" : "elastic search",
    "fields" : [ "title^2", "content" ],
    "type" : "best_fields"
  }
}

Note: The type parameter controls how the query is executed across multiple fields. For example, best_fields will find the best matching field and use its score, while most_fields combines scores from all matching fields.