Elasticsearch is an open-source, distributed search and analytics engine built on Apache Lucene, offering full-text search, log analytics, vector/semantic search, and real-time data analysis across petabyte-scale datasets. At its core, Elasticsearch uses an inverted index that maps terms to documents, enabling sub-second query responses even across billions of records. Since version 8.x the platform has expanded rapidly into AI-powered search — introducing the semantic_text field, ELSER sparse vectors, BBQ quantization, and a dedicated ES|QL piped query language that is now production-ready. Understanding how queries interact with mappings, analyzers, aggregations, and the new inference layer is essential: a poorly designed mapping or analyzer can turn a millisecond query into a multi-second timeout.
What This Cheat Sheet Covers
This topic spans 16 focused tables and 205 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Core Query Types
| Query | Example | Description |
|---|---|---|
{"query": {"match": {"title": "search"}}} | • Full-text search with analysis and relevance scoring • automatically tokenizes and analyzes input • default query for text fields. | |
{"query": {"term": {"status.keyword": "active"}}} | • Exact match for non-analyzed fields (keyword, IDs, enum values) • case-sensitive • no analysis applied • fastest for structured data. | |
{"query": {"bool": {"must": [...], "should": [...], "filter": [...]}}} | • Combines queries with boolean logic • must scores + requires; filter requires without scoring (cached); should boosts; must_not excludes. | |
{"query": {"range": {"age": {"gte": 18, "lt": 65}}}} | • Matches documents with field values within a range • supports gte, gt, lte, lt• works with numbers, dates, and text. | |
{"query": {"multi_match": {"query": "search", "fields": ["title^2", "body"]}}} | • Searches across multiple fields simultaneously • supports field boosting with ^• types: best_fields, most_fields, cross_fields. | |
{"query": {"match_phrase": {"content": "quick brown fox"}}} | • Searches for exact phrase in specified order • terms must appear consecutively • supports slop for proximity matching. | |
{"query": {"fuzzy": {"text": {"value": "elasticsearch", "fuzziness": "AUTO"}}}} | • Handles typos and misspellings using Levenshtein edit distance • fuzziness can be 0, 1, 2, or AUTO. | |
{"query": {"query_string": {"query": "title:elasticsearch AND status:published"}}} | • Supports full Lucene query syntax with AND, OR, NOT operators and field-specific searches • powerful but fragile on user input. |