Elasticsearch 常见 Query 搜索

Elasticsearch 常见 Query 搜索，部分内容来自 B 站中华石杉 Elasticsearch 顶尖高手系列课程核心知识篇，英文内容来自官方文档。

match all

The most simple query, which matches all documents, giving them all a _score of 1.0

GET /_search{    "query": {        "match_all": {}    }}

The _score can be changed with the boost parameter:

GET /_search{  "query": {    "match_all": { "boost": 1.2 }  }}

Match None Query

This is the inverse of the match_all query, which matches no document

GET /_search{  "query": {    "match_none": {}  }}

Full text queries

The full text query enable you to search analyzed text fields such as the body of an email. The query string is processed using the same analyzer that was applied to the field during indexing.

match

Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.

The match query is the standard query for performing a full-text search, include options for fuzzy matching.

GET /_search{  "query": {    "match": {      "title": "my elasticsearch article"    }  }}

The match query is of type boolean. It means that the text provided is analyzed and the analysis process constructs a boolean query from the provided text.

The operator parameter can be set to or  or and to control the boolean clauses (defaults to or).

GET /_search{  "query": {    "match": {      "title": {        "query": "my elasticsearch article",        "operator": "and"      }    }  }}

之前的查询可以查到 7 条数据，修改为 and 之后，就一条也没有了。

multi match

The multi_match query builds on the match query to allow multi-field queries:

GET /_search{  "query": {    "multi_match": {      // the query string      "query": "this is a test",      // the fields to be queried      "fields": ["subject", "message"]    }  }}

fields and per-field boosting

Fields can be specified with wildcards.

GET /_search{  "query": {    "multi_match": {      "query": "Will Smith",      // Query the title, first_name and last_name fields      "fields": [ "title", "*_name" ]    }  }}

individual fields can be boosted with the caret(^) notation

GET /_search{  "query": {    "multi_match": {      "query": "this is a test",      // The query multiplies the subject field's score by three but leaves the message field's score unchanged      "fields": [ "subject^3 ", "message"]    }}

If no fields are provided, the multi_match query defaults to the index.query.default_field index settings, which in turn defaults to *.* extracts all fields in the mapping that are eligible to term queries and filters the metadata fields. All extracted fields are then combined to build a query.

There is a limit on the number of fields that can be queried at once. It is defined by the indices.query.bool.max_clause_count Search settings which defaults to 1024.

GET /test_index/_search{  "query": {    "multi_match": {      "query": "test",      "fields": ["test_field", "test_field1"]    }  }}

Term-level queries

You can use term-level queries to find documents based on precise values in structured data.

Term-level queries do not analyze search terms, it match the exact terms stored in a field.

Term-level queries still normalize search terms for keyword fields with the normalizer property.

Types of term-level queries

• exists query

• fuzzy query

• ids query

• prefix query

• range query

• regexp query

• term query

• terms query

• type query

• wildcard query

range query

Return documents that contain terms within a provided range.

GET /_search{  "query": {    "range": {      "age": {        "gte": 10,        "lte": 20,        "boost": 2.0      }    }  }}

Using the range query with date fields

GET /_search{  "query": {    "range": {      "timestamp": {        "gte": "now-1d/d",        "lt": "now/d"      }    }  }}

Example query using time_zone parameter

GET /_search{  "query": {    "range": {      "timestamp": {        // Indicates that date values use a UTC offset of +01:00        "time_zone": "+01:00",        // With a UTC offset of +01:00, Elasticsearch converts this date to 2019-12-31T23:00:00 UTC        "gte": "2020-01-01T00:00:00",        // The time_zone parameter does not affect the now value.        "lte": "now"      }    }  }}

GET /employee/_search{  "query": {    "range": {      "age": {        "gte": 30      }    }  }}

Term query

Returns documents that contain an exact term in a provided field.

You can use the term query to find document based on a precise value such as a price, a product ID, or a username.

Avoid using the term query for text fields.

To search text field values, use the match query instead.

GET /test_index/_search{  "query": {    "term": {      "test_field": "test hello"    }  }}

Terms query

Returns documents that contain one or more exact terms in a provided field.

The terms query is the same as the term query, except you can search for multiple values.

GET /_search{  "query": {    "terms": {      "user.id": ["kimchy", "elkbee"],      "boost": 1.0    }  }}

GET /_search{  "query": {    "terms": {      "tag": ["search", "full_text", "nosql"]    }  }}

Terms lookup

Terms lookup fetches the field values of an existing document. Elasticsearch then uses those values as search terms. This can be helpful when searching for a large set of terms.

PUT my-index-000014{  "mappings": {    "properties": {      "color": {        "type": "keyword"      }    }  }}
PUT my-index-000014/_doc/1{  "color": ["blue", "green"]}
PUT my-index-000014/_doc/2{  "color": "blue"}
GET my-index-000014/_search?pretty{  "query": {    "terms": {      "color": {        "index": "my-index-000014",        "id": "2",        "path": "color"      }    }  }}

exist query

Returns documents that contain an indexed value for a field.

GET /_search{  "query": {    "exists": {      "field": "user"    }  }}

Find documents missing indexed values

To find documents that are missing an indexed value for a field,  use the must_not boolean query with the exists query.

GET /_search{  "query": {    "bool": {      "must_not": {        "exists": {          "field": "user.id"        }      }    }  }}