Elasticsearch is an open-source, distributed search and analytics engine built on Apache Lucene, offering full-text search, log analytics, vector/semantic search, and real-time data analysis across petabyte-scale datasets. At its core, Elasticsearch uses an inverted index that maps terms to documents, enabling sub-second query responses even across billions of records. Since version 8.x the platform has expanded rapidly into AI-powered search — introducing the semantic_text field, ELSER sparse vectors, BBQ quantization, and a dedicated ES|QL piped query language that is now production-ready. Understanding how queries interact with mappings, analyzers, aggregations, and the new inference layer is essential: a poorly designed mapping or analyzer can turn a millisecond query into a multi-second timeout.
What This Cheat Sheet Covers
This topic spans 16 focused tables and 205 indexed concepts, 173 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Core Query Types
The building blocks of every Elasticsearch search live in the Query DSL, and the single most important distinction is whether a query is analyzed or not—match tokenizes and scores for full-text relevance, while term demands an exact match on keyword fields. Get this right and you compose the rest with bool, range, fuzzy matching, and the newer semantic sparse_vector query.
| Query | Example | Description | |
|---|---|---|---|
{"query": {"match": {"title": "search"}}} | • Full-text search with analysis and relevance scoring • automatically tokenizes and analyzes input • default query for text fields. | ||
{"query": {"term": {"status.keyword": "active"}}} | • Exact match for non-analyzed fields (keyword, IDs, enum values) • case-sensitive • no analysis applied • fastest for structured data. | ||
{"query": {"bool": {"must": [...], "should": [...], "filter": [...]}}} | • Combines queries with boolean logic • must scores + requires; filter requires without scoring (cached); should boosts; must_not excludes. | ||
{"query": {"range": {"age": {"gte": 18, "lt": 65}}}} | • Matches documents with field values within a range • supports gte, gt, lte, lt• works with numbers, dates, and text. | ||
{"query": {"multi_match": {"query": "search", "fields": ["title^2", "body"]}}} | • Searches across multiple fields simultaneously • supports field boosting with ^• types: best_fields, most_fields, cross_fields. | ||
{"query": {"match_phrase": {"content": "quick brown fox"}}} | • Searches for exact phrase in specified order • terms must appear consecutively • supports slop for proximity matching. | ||
{"query": {"fuzzy": {"text": {"value": "elasticsearch", "fuzziness": "AUTO"}}}} | • Handles typos and misspellings using Levenshtein edit distance • fuzziness can be 0, 1, 2, or AUTO. | ||
{"query": {"query_string": {"query": "title:elasticsearch AND status:published"}}} | • Supports full Lucene query syntax with AND, OR, NOT operators and field-specific searches • powerful but fragile on user input. | ||
{"query": {"prefix": {"name": "elastics"}}} | • Matches documents where field starts with specified prefix • case-sensitive on keyword fields • faster than wildcard for prefixes. | ||
{"query": {"exists": {"field": "tags"}}} | • Finds documents where field has any non-null value • use with must_not to find missing fields. | ||
{"query": {"sparse_vector": {"field": "content_embedding", "inference_id": "my-elser-endpoint", "query": "muscle soreness after running"}}} | • Performs semantic search using ELSER sparse vectors • sends query text to inference endpoint, compares token-weight pairs • requires sparse_vector field. | ||
{"query": {"rule": {"match_criteria": {"user_query": "shoes"}, "ruleset_ids": ["my-ruleset"], "organic": {"match": {"description": "shoes"}}}}} | • Applies query rules (curated promotion/exclusion) before returning organic results • supports pinned and exclude rule types. | ||
{"query": {"wildcard": {"name": "*son"}}} | • Pattern matching with * (zero or more) and ? (single character)• slower than other queries • avoid leading wildcards. | ||
{"query": {"ids": {"values": ["1", "2", "3"]}}} | • Retrieves documents by _id field values• efficient for fetching specific known documents. | ||
{"query": {"match_all": {}}} | • Returns all documents with equal relevance score of 1.0 • useful as base for filtered queries and testing. |