Working with Compound Queries

1. Using Bool Query

The bool query in Elasticsearch is a powerful way to combine multiple queries using boolean logic. It allows you to construct complex queries by combining sub-queries with must, should, must_not, and filter clauses.

Clause	Description	Usage
must	Queries that must match for a document to be included in the results.	`"must": [{ "term": { "status": "published" } }]`
should	Queries that should match for a document to be included, but not required.	`"should": [{ "match": { "title": "elasticsearch" } }]`
must_not	Queries that must NOT match for a document to be included in the results.	`"must_not": [{ "term": { "status": "draft" } }]`
filter	Queries that are used to filter documents, without affecting the score.	`"filter": [{ "range": { "age": { "gte": 18 } } }]`

Example: Bool Query with Multiple Clauses

{
  "query": {
    "bool": {
      "must": [
        { "term": { "status": "published" } }
      ],
      "should": [
        { "match": { "title": "elasticsearch" } }
      ],
      "must_not": [
        { "term": { "status": "draft" } }
      ],
      "filter": [
        { "range": { "age": { "gte": 18 } } }
      ]
    }
  }
}

Note: The filter clause is more efficient than must for queries that do not require scoring, as it can cache results and is optimized for performance.

2. Understanding Bool Query Scoring

Field	Description	Values
boost	Boost factor for the query	`float`
minimum_should_match	Minimum number of should clauses that must match	`int` or `string`
adjust_pure_negative	Adjust score for queries with only negative clauses	`boolean`

Example: Bool Query with Scoring

{
  "bool": {
    "must": [
      {
        "term": {
          "status": "published"
        }
      }
    ],
    "should": [
      {
        "match": {
          "title": "elasticsearch"
        }
      },
      {
        "match": {
          "content": "query"
        }
      }
    ],
    "minimum_should_match": 1,
    "boost": 1.5
  }
}

Note: The score of a bool query is computed based on the scores of its clauses, with must and should clauses contributing to the overall score, while must_not clauses do not contribute directly.

3. Using Boosting Query

The boosting query in the ELK Stack is used to adjust the relevance score of documents based on a boost factor. It allows you to increase or decrease the importance of certain documents in search results.

Field	Description	Values
boosting	Defines the boosting query configuration	`{ "boosting": { "positive": { ... }, "negative": { ... }, "negative_boost": 0.5 } }`

Example: Boosting Query Configuration

{
  "query": {
    "boosting": {
      "positive": {
        "match": {
          "title": "elasticsearch"
        }
      },
      "negative": {
        "match": {
          "title": "mongodb"
        }
      },
      "negative_boost": 0.5
    }
  }
}

Note: The negative_boost value should be less than 1 to reduce the score of documents matching the negative query.

Boosting Query Use Cases

Adjust relevance scores based on document categories.
Decrease the impact of irrelevant results in search results.
Improve search accuracy by boosting preferred content.

4. Using Constant Score Query

Property	Description	Values	Notes
query	The query to be wrapped in a constant score	`object`	Any valid Elasticsearch query
boost	Boost factor for the constant score	`float`	Default is 1.0

Example: Constant Score Query

{
  "constant_score": {
    "query": {
      "term": {
        "status": "active"
      }
    },
    "boost": 2.0
  }
}

Note: The constant_score query is useful for applying a fixed boost to a query without affecting the scoring mechanism.

5. Using Dis Max Query

The dis_max query in the ELK Stack is used to combine multiple queries and return documents that match any of the provided queries, with a score calculated based on the maximum score from the matching subqueries.

Property	Description	Values
query	The main query to execute	`dis_max`
queries	List of queries to be evaluated	Array of query objects
tie_breaker	Factor to balance between max score and sum of scores	`0.0` to `1.0`

Example: Dis Max Query

{
  "query": {
    "dis_max": {
      "queries": [
        {
          "match": {
            "title": "elasticsearch"
          }
        },
        {
          "match": {
            "description": "elasticsearch"
          }
        }
      ],
      "tie_breaker": 0.7
    }
  }
}

Note: The tie_breaker parameter controls how much the score from the best matching query contributes to the final score. A value of 0.0 means only the best score is considered, while 1.0 includes all scores in a sum.

6. Using Function Score Query

The function_score query in Elasticsearch allows you to modify the score of documents based on a function that is calculated from document fields or other factors. This is useful for boosting or demoting documents based on criteria like freshness, popularity, or custom logic.

Property	Description	Values
query	The query to score	Any valid Elasticsearch query
functions	Array of function definitions to apply	Object array with function details
boost_mode	How to combine function scores with the original query score	`multiply`, `sum`, `avg`, `max`, `min`
max_boost	Maximum boost value to apply	Number

Example: Boosting by Field Value

{
  "function_score": {
    "query": {
      "match": {
        "title": "elasticsearch"
      }
    },
    "functions": [
      {
        "field_value_factor": {
          "field": "popularity",
          "factor": 1.2
        }
      }
    ],
    "boost_mode": "multiply"
  }
}

Example: Using Decay Function

{
  "function_score": {
    "query": {
      "match_all": {}
    },
    "functions": [
      {
        "gauss": {
          "date": {
            "origin": "2024-01-01",
            "scale": "30d",
            "offset": "10d"
          }
        }
      }
    ],
    "boost_mode": "multiply"
  }
}

Note: The function_score query is particularly powerful when combined with other queries, such as match, bool, or range queries, to refine search results based on document relevance.

7. Nesting Bool Queries

Property	Description	Values	Notes
bool	Combines multiple queries using boolean logic	`must`, `should`, `must_not`, `filter`	Used to build complex queries with nested conditions
must	Queries that must match for the document to be included	`query`	Equivalent to AND logic
should	Queries that should match for the document to be included	`query`	Equivalent to OR logic
must_not	Queries that must NOT match for the document to be included	`query`	Equivalent to NOT logic
filter	Queries that must match but do not contribute to scoring	`query`	Used for filtering without affecting relevance score

Example: Nesting Bool Queries

{
  "bool": {
    "must": [
      {
        "term": {
          "status": "active"
        }
      }
    ],
    "should": [
      {
        "match": {
          "title": "Elasticsearch"
        }
      }
    ],
    "must_not": [
      {
        "range": {
          "age": {
            "lt": 18
          }
        }
      }
    ]
  }
}

Note: The filter clause is often used for performance optimization as it does not affect scoring.

8. Using Minimum Should Match

The minimum_should_match parameter in Elasticsearch allows you to specify the minimum number of optional clauses that must match in a bool query. This is particularly useful when you have a combination of must, should, and must_not clauses.

Parameter	Description	Values	Notes
minimum_should_match	Minimum number of `should` clauses that must match	`1`, `2`, `3`, etc.	Can also use percentage values like `50%`

Example: Using minimum_should_match in a bool query

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "status": "published"
          }
        }
      ],
      "should": [
        {
          "match": {
            "title": "elasticsearch"
          }
        },
        {
          "match": {
            "content": "query"
          }
        },
        {
          "match": {
            "tags": "search"
          }
        }
      ],
      "minimum_should_match": 2
    }
  }
}

Note: The minimum_should_match parameter only applies to should clauses and does not affect must or must_not clauses.

Key Points

minimum_should_match ensures that at least a specified number of should clauses match.
It is useful for filtering results based on a combination of optional conditions.
Values can be numeric (e.g., 2) or percentage-based (e.g., 50%).

9. Combining Query and Filter Context

Context	Description	Usage
query	Defines the search criteria for matching documents	Used to filter documents based on specific fields and values
filter	Applies filters to the query without affecting scoring	Improves performance by using filter context instead of query context

Example: Using Query and Filter Context

{
  "bool": {
    "must": [
      {
        "match": {
          "title": "Elasticsearch"
        }
      }
    ],
    "filter": [
      {
        "range": {
          "publish_date": {
            "gte": "2020-01-01"
          }
        }
      }
    ]
  }
}

Note: The filter context is more efficient for filtering because it does not calculate relevance scores.

10. Using Named Queries

Property	Description	Example
query.name	Name of the query to be referenced later	`"my_named_query"`
query.definition	Actual query content to be stored and reused	`{ "match": { "status": "active" } }`

Example: Define a Named Query

{
  "query": {
    "name": "active_users",
    "definition": {
      "match": {
        "status": "active"
      }
    }
  }
}

Example: Use a Named Query in Search

{
  "query": {
    "named": "active_users"
  }
}