Query API in Elasticsearch

Introduction

The Query API in Elasticsearch is a powerful tool that allows you to search and retrieve data stored in an Elasticsearch index. This tutorial will cover the basics of the Query API, including how to perform simple queries, use query filters, and understand the results returned by Elasticsearch.

Getting Started

Before you can start querying Elasticsearch, you need to have an Elasticsearch instance running and an index with some data. For this tutorial, we'll assume you have an Elasticsearch instance running on localhost:9200 and an index named my_index.

Basic Query

The most basic query you can perform is a match query. This query searches for documents that match a given text, number, date, or boolean value. Here is an example of a match query:

POST /my_index/_search
{
  "query": {
    "match": {
      "field_name": "search_text"
    }
  }
}
                

This query searches for documents in the my_index index where the field_name contains the text search_text.

Using Filters

Filters are used to narrow down the search results. They are faster and more efficient than queries because they do not score the results. Here is an example of a filtered query:

POST /my_index/_search
{
  "query": {
    "bool": {
      "must": {
        "match": {
          "field_name": "search_text"
        }
      },
      "filter": {
        "term": {
          "status": "active"
        }
      }
    }
  }
}
                

This query searches for documents where field_name contains search_text and status is active.

Understanding the Results

Elasticsearch returns the search results in a JSON format. Here is an example of the results returned by a search query:

{
  "took": 10,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 1,
      "relation": "eq"
    },
    "max_score": 1.0,
    "hits": [
      {
        "_index": "my_index",
        "_type": "_doc",
        "_id": "1",
        "_score": 1.0,
        "_source": {
          "field_name": "search_text",
          "status": "active"
        }
      }
    ]
  }
}
                

The hits section contains the search results. Each result has metadata such as the index, type, ID, score, and the document source.

Advanced Queries

Elasticsearch supports more advanced queries such as range queries, wildcard queries, and fuzzy queries. Here is an example of a range query:

POST /my_index/_search
{
  "query": {
    "range": {
      "age": {
        "gte": 30,
        "lte": 40
      }
    }
  }
}
                

This query searches for documents where the age field is between 30 and 40.

Conclusion

In this tutorial, we covered the basics of the Query API in Elasticsearch. We learned how to perform simple queries, use filters, and understand the results. We also looked at some advanced query options. With this knowledge, you can start building more complex search queries to retrieve the data you need from Elasticsearch.