Show Menu
Cheatography

Elasticsearch query string syntax Cheat Sheet by

Examples for using elasticsearch (lucene) query string syntax

Field names

where "­sta­tus­" field contains "­act­ive­"
statu­s:a­ctive

"­tit­le" field contains "­qui­ck" or "­bro­wn". If you omit the OR operator the default operator will be used
title­:(quick OR brown)
title­:(quick brown)

where "­aut­hor­" field contains the exact phrase "john smith"
autho­r:"John Smith"

where any of the fields "­boo­k.t­itl­e", "­boo­k.c­ont­ent­" or "­boo­k.d­ate­" contains quick or brown (note how we need to escape the "­*" with a backslash
book.­*:­(quick brown)

where the field "­tit­le" has no value (or is missing):
_miss­ing­_:t­itle

where the field "­tit­le" has any non-null value:
_exis­ts_­:title

Wildcards

Wildcard searches can be run on individual terms, using "­?" to replace a single character, and "­*" to replace zero or more characters
qu?ck bro*
note: wildcard queries can use an enormous amount of memory and perform very badly

Regular expres­sions

Regular expression patterns can be embedded in the query string by wrapping them in forwar­d-s­lashes ("/")
name:­/jo­h?n­(at­h[o­a]n)/

Grouping

Multiple terms or clauses can be grouped together with parent­heses, to form sub-qu­eries:
(quick OR brown) AND fox
Groups can be used to target a particular field, or to boost the result of a sub-query:
statu­s:(­active OR pending) title:­(full text search)^2
 

Fuzziness

search for terms that are similar to, but not exactly like the used search terms, using the "­fuz­zy"' operator
quikc~ brwn~ foks~

The default edit distance is 2, but an edit distance of 1 should be sufficient to catch 80% of all human misspe­llings.
It can be specified as
quikc~1

Proximity searches

While a phrase query (eg "john smith") expects all of the terms in exactly the same order, a proximity query allows the specified words to be further apart or in a different order. A proximity search allows us to specify a maximum edit distance of words in a phrase:
"fox quick"~5

Ranges

Ranges can be specified for date, numeric or string fields. Inclusive ranges are specified with square brackets [min TO max] and exclusive ranges with curly brackets {min TO max}.
All days in 2012
date:­[20­12-­01-01 TO 2012-1­2-31]

Numbers 1..5
count:[1 TO 5]

Tags between alpha and omega, excluding alpha and omega
tag:{­alpha TO omega}

Numbers from 10 upwards
count:[10 TO *]

Dates before 2012
date:{* TO 2012-0­1-01}

Numbers from 1 up to but not including 5
count:[1 TO 5}

Boolean operators

+ (this term must be present) and - (this term must not be present)
All other terms are optional
quick brown +fox -news

Help Us Go Positive!

We offset our carbon usage with Ecologi. Click the link below to help us!

We offset our carbon footprint via Ecologi
 

Comments

No comments yet. Add yours below!

Add a Comment

Your Comment

Please enter your name.

    Please enter your email address

      Please enter your Comment.