Show Menu
Cheatography

Elasticsearch query string syntax Cheat Sheet by

Examples for using elasticsearch (lucene) query string syntax

Field names

where "­sta­tus­" field contains "­act­ive­"
status­:active


"­tit­le" field contains "­qui­ck" or "­bro­wn". If you omit the OR operator the default operator will be used
title:­(quick OR brown)

title:­(quick brown)


where "­aut­hor­" field contains the exact phrase "john smith"
author­:"John Smith"


where any of the fields "­boo­k.t­itl­e", "­boo­k.c­ont­ent­" or "­boo­k.d­ate­" contains quick or brown (note how we need to escape the "­*" with a backslash
book.*­:(quick brown)


where the field "­tit­le" has no value (or is missing):
_missi­ng_­:title


where the field "­tit­le" has any non-null value:
_exist­s_:­title

Wildcards

Wildcard searches can be run on individual terms, using "­?" to replace a single character, and "­*" to replace zero or more characters
qu?ck bro*
note: wildcard queries can use an enormous amount of memory and perform very badly

Regular expres­sions

Regular expression patterns can be embedded in the query string by wrapping them in forwar­d-s­lashes ("/")
name:/­joh­?n(­ath­[oa]n)/

Grouping

Multiple terms or clauses can be grouped together with parent­heses, to form sub-qu­eries:
(quick OR brown) AND fox

Groups can be used to target a particular field, or to boost the result of a sub-query:
status­:(a­ctive OR pending) title:­(full text search)^2
 

Fuzziness

search for terms that are similar to, but not exactly like the used search terms, using the "­fuz­zy"' operator
quikc brwn foks~


The default edit distance is 2, but an edit distance of 1 should be sufficient to catch 80% of all human misspe­llings.
It can be specified as
quikc~1

Proximity searches

While a phrase query (eg "john smith") expects all of the terms in exactly the same order, a proximity query allows the specified words to be further apart or in a different order. A proximity search allows us to specify a maximum edit distance of words in a phrase:
"fox quick"~5

Ranges

Ranges can be specified for date, numeric or string fields. Inclusive ranges are specified with square brackets [min TO max] and exclusive ranges with curly brackets {min TO max}.
All days in 2012
date:[­201­2-01-01 TO 2012-1­2-31]


Numbers 1..5
count:[1 TO 5]


Tags between alpha and omega, excluding alpha and omega
tag:{alpha TO omega}


Numbers from 10 upwards
count:[10 TO *]


Dates before 2012
date:{* TO 2012-0­1-01}


Numbers from 1 up to but not including 5
count:[1 TO 5}

Boolean operators

+ (this term must be present) and - (this term must not be present)
All other terms are optional
quick brown +fox -news
 

Comments

No comments yet. Add yours below!

Add a Comment

Your Comment

Please enter your name.

    Please enter your email address

      Please enter your Comment.