Elasticsearch query string syntax Cheat Sheet

A cheat sheet in English by jelle

Examples for using elasticsearch (lucene) query string syntax

44,459 views 12,272 downloads 4 Dec 2015 History
3.7 avg · 0 ratings

Field names

where "­sta­tus­" field contains "­act­ive­"
status­:active

"­tit­le" field contains "­qui­ck" or "­bro­wn". If you omit the OR operator the default operator will be used
title:­(quick OR brown)
title:­(quick brown)

where "­aut­hor­" field contains the exact phrase "john smith"
author­:"John Smith"

where any of the fields "­boo­k.t­itl­e", "­boo­k.c­ont­ent­" or "­boo­k.d­ate­" contains quick or brown (note how we need to escape the "­*" with a backslash
book.*­:(quick brown)

where the field "­tit­le" has no value (or is missing):
_missi­ng_­:title

where the field "­tit­le" has any non-null value:
_exist­s_:­title

Wildcards

Wildcard searches can be run on individual terms, using "­?" to replace a single character, and "" to replace zero or more characters
qu?ck bro
note: wildcard queries can use an enormous amount of memory and perform very badly

Regular expres­sions

Regular expression patterns can be embedded in the query string by wrapping them in forwar­d-s­lashes ("/")
name:/­joh­?n(­ath­[oa]n)/

Grouping

Multiple terms or clauses can be grouped together with parent­heses, to form sub-qu­eries:
(quick OR brown) AND fox
Groups can be used to target a particular field, or to boost the result of a sub-query:
status­:(a­ctive OR pending) title:­(full text search)^2

Fuzziness

search for terms that are similar to, but not exactly like the used search terms, using the "­fuz­zy"' operator
quikc brwn foks

The default edit distance is 2, but an edit distance of 1 should be sufficient to catch 80% of all human misspe­llings.
It can be specified as
quikc1

Proximity searches

While a phrase query (eg "john smith") expects all of the terms in exactly the same order, a proximity query allows the specified words to be further apart or in a different order. A proximity search allows us to specify a maximum edit distance of words in a phrase:
"fox quick"~5

Ranges

Ranges can be specified for date, numeric or string fields. Inclusive ranges are specified with square brackets [min TO max] and exclusive ranges with curly brackets {min TO max}.
All days in 2012
date:[­201­2-01-01 TO 2012-1­2-31]

Numbers 1..5
count:[1 TO 5]

Tags between alpha and omega, excluding alpha and omega
tag:{alpha TO omega}

Numbers from 10 upwards
count:[10 TO ]

Dates before 2012
date:{
TO 2012-0­1-01}

Numbers from 1 up to but not including 5
count:[1 TO 5}

Boolean operators

+ (this term must be present) and - (this term must not be present)
All other terms are optional
quick brown +fox -news

Badges

Useful Cheat Sheet Great Cheat Sheet Nice Cheat Sheet Good Cheat Sheet Downloaded from Unusual Locations × 2 🇵🇹 Big in Portugal 🇵🇱 Big in Poland

Comments

No comments yet.

Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.