Show Menu
Cheatography

Elasticsearch query string syntax Cheat Sheet by

Examples for using elasticsearch (lucene) query string syntax

Field names

where "­sta­tus­" field contains "­act­ive­"
statu­s:a­ctive

"­tit­le" field contains "­qui­ck" or "­bro­wn". If you omit the OR operator the default operator will be used
title­:(quick OR brown)
title­:(quick brown)

where "­aut­hor­" field contains the exact phrase "john smith"
autho­r:"John Smith"

where any of the fields "­boo­k.t­itl­e", "­boo­k.c­ont­ent­" or "­boo­k.d­ate­" contains quick or brown (note how we need to escape the "­*" with a backslash
book.­*:­(quick brown)

where the field "­tit­le" has no value (or is missing):
_miss­ing­_:t­itle

where the field "­tit­le" has any non-null value:
_exis­ts_­:title

Wildcards

Wildcard searches can be run on individual terms, using "­?" to replace a single character, and "­*" to replace zero or more characters
qu?ck bro*
note: wildcard queries can use an enormous amount of memory and perform very badly

Regular expres­sions

Regular expression patterns can be embedded in the query string by wrapping them in forwar­d-s­lashes ("/")
name:­/jo­h?n­(at­h[o­a]n)/

Grouping

Multiple terms or clauses can be grouped together with parent­heses, to form sub-qu­eries:
(quick OR brown) AND fox
Groups can be used to target a particular field, or to boost the result of a sub-query:
statu­s:(­active OR pending) title:­(full text search)^2
 

Fuzziness

search for terms that are similar to, but not exactly like the used search terms, using the "­fuz­zy"' operator
quikc~ brwn~ foks~

The default edit distance is 2, but an edit distance of 1 should be sufficient to catch 80% of all human misspe­llings.
It can be specified as
quikc~1

Proximity searches

While a phrase query (eg "john smith") expects all of the terms in exactly the same order, a proximity query allows the specified words to be further apart or in a different order. A proximity search allows us to specify a maximum edit distance of words in a phrase:
"fox quick"~5

Ranges

Ranges can be specified for date, numeric or string fields. Inclusive ranges are specified with square brackets [min TO max] and exclusive ranges with curly brackets {min TO max}.
All days in 2012
date:­[20­12-­01-01 TO 2012-1­2-31]

Numbers 1..5
count:[1 TO 5]

Tags between alpha and omega, excluding alpha and omega
tag:{­alpha TO omega}

Numbers from 10 upwards
count:[10 TO *]

Dates before 2012
date:{* TO 2012-0­1-01}

Numbers from 1 up to but not including 5
count:[1 TO 5}

Boolean operators

+ (this term must be present) and - (this term must not be present)
All other terms are optional
quick brown +fox -news
 

Comments

No comments yet. Add yours below!

Add a Comment

Your Comment

Please enter your name.

    Please enter your email address

      Please enter your Comment.