The simplest query in Elasticsearch is match_all query that matches all the documents. It gives a generous _score of 1.0 to each document in the index. The syntax of the match_all query is as follows:

{
   "query": {
      "match_all": {}
   }
}

The text passed inside a match query goes through the analysis phase and, depending on the operator (which defaults to OR), documents are matched. For example:

{
  "query": {
    "match": {
      "text": "Build Great Web Apps",
      "operator" : "and"
    }
  }
}

The preceding query will match the documents that contain the Build, Great, Web, and Apps terms in the text field. If we had used the OR operator, it would have matched the documents containing any of these terms.

{
  "query": {
    "match": {
      "text": ""Build Great Web Apps""
    }
  }
}

{
  "query": {
    "match": {
      "text": "Build Great Web Apps",
      "type" : "phrase"
    }
  }
}

The multi_match query is similar to the match query but it provides options to search the same terms in more than one field at one go. For example:

{
  "query": {
  "multi_match": {
    "query": "Build Great Web Apps",
    "fields": ["text","retweeted_status.text"]
  }
  }
}

The preceding query will search the words Build, Great, Web, and Apps inside the two fields text and retweeted_status.text, and will return the relevant results in a sorted order based on the score each document gets. If you want to match only those documents in which all the terms are present, then use the and keyword in the operator parameter.

In comparison to all the other queries available in Elasticsearch, the query_string query provides a full Lucene syntax to be used in it. It uses a query parser to construct an actual query out of the provided text. Similar to the match query, it also goes through the analysis phase. The following is the syntax for query_string:

{
  "query": {
    "query_string": {
      "default_field": "text",
      "query": "text:analytics^2 +text:data -user.name:d_bharvi"
    }
  }
}

The match query that we used in the previous section can be written using a query string in the following way:

{
  "query": {
    "query_string": {
      "default_field": "text",
      "query": "Build Great Web Apps"
    }
  }
}

The term query does an exact term matching in a given field. So, you need to provide the exact term to get the correct results. For example, if you have used a lowercase filter while indexing, you need to pass the terms in lowercase while querying with the term query.

The syntax for a term query is as follows:

{
  "query": {
    "term": {
      "text": "elasticsearch"
    }
  }
}

If you want to search more than one term in a single field, you can use the terms query. For example, to search all the tweets in which the hashtags used are either bomb or blast, you can write a query like this:

{
  "query": {
    "terms": {
      "entities.hashtags": [
        "bomb",
        "blast"
      ],
      "minimum_match": 1
    }
  }
}

The minimum_match specifies the number of minimum terms that should match in each document. This parameter is optional.

Range queries are used to find data within a certain range. The syntax of a range query is as follows and is the same for date fields as well as number fields such as integer, long, and so on:

{
  "query": {
    "range": {
      "user.followers_count": {
        "gte": 100,
        "lte": 200
      }
    }
  }
}

The preceding query will find all the tweets created by users whose follower count is between 100 and 200. The parameters supported in the range queries are: gt, lt, gte, and lte.

Range queries on dates allow date math operations. So, for example, if you want to find all the tweets from the last one hour, you can use the following query:

{
  "query": {
    "range": {
      "created_at": {
        "gt": "now-1h"
      }
    }
  }
}

Similarly, months (M), minutes (m), years (y), and seconds (s) are allowed in the query.

The exists query matches documents that have at least one non-value in a given field. For example, the following query will find all the tweets that are replies to any other tweet:

{
  "query":{
    "constant_score":{
      "filter":{
        "exists":{"field":"in_reply_to_user_id"}
      }
    }
  }
}

Missing queries are the opposite of exists queries. They are used to find the documents that contain null values. For instance, the following query finds all the tweets that do not contain any hashtags:

{
  "query":{
    "constant_score":{
      "filter":{
        "missing":{"field":"hashtags"}
      }
    }
  }
}

Bool queries allow us to wrap up many queries clauses together including bool clauses. The documents are matched based on the combinations of these Boolean clauses that are listed as follows:

There are some additional parameters supported by bool queries that are listed here:

In the preceding example, inside the text field, we are looking for the terms turmoil and riot, which are synonyms of each other. In these cases, we do not care how many synonyms are present in the document since all have the same meaning. In these kinds of scenarios, we can disable query coordination by setting disable_coord to true, so that similar clauses do not impact the score factor computation.

The not query is used to filter out the documents that match the query. For example, we can use the following to get the tweets that are not created within a certain range of time:

{
  "filter": {
    "not": {
      "filter": {
        "range": {
          "created_at": {
            "from": "2015-10-01",
            "to": "2010-10-30"
          }
        }
      }
    }
  }
}

Please note that any filter can be used inside bool queries with the must, must_not, or should blocks.