Elasticsearch query string syntax Cheat Sheet
Field names Fuzziness
where "status" field contains "active" search for terms that are similar to, but not exactly like
status:active the used search terms, using the "fuzzy"' operator
quikc~ brwn~ foks~
"title" field contains "quick" or "brown". If you omit
the OR operator the default operator will be used The default edit distance is 2, but an edit distance of 1
title:(quick OR brown) should be sufficient to catch 80% of all human
title:(quick brown)
misspellings.
It can be specified as
where "author" field contains the exact phrase "john quikc~1
smith" Proximity searches
author:"John Smith"
While a phrase query (eg "john smith") expects all of
where any of the fields "book.title", "book.content" or
the terms in exactly the same order, a proximity query
"book.date" contains quick or brown (note how we
allows the specified words to be further apart or in a
need to escape the "*" with a backslash
book.*:(quick brown) different order. A proximity search allows us to
specify a maximum edit distance of words in a phrase:
"fox quick"~5
where the field "title" has no value (or is missing):
_missing_:title Ranges
where the field "title" has any non-null value: Ranges can be specified for date, numeric or string
_exists_:title fields. Inclusive ranges are specified with square
Wildcards brackets [min TO max] and exclusive ranges with
curly brackets {min TO max}.
Wildcard searches can be run on individual terms, All days in 2012
using "?" to replace a single character, and "*" to date:[2012-01-01 TO 2012-12-31]
replace zero or more characters
qu?ck bro* Numbers 1..5
note: wildcard queries can use an enormous amount count:[1 TO 5]
of memory and perform very badly
Tags between alpha and omega, excluding alpha and
omega
Regular expressions tag:{alpha TO omega}
Regular expression patterns can be embedded in the Numbers from 10 upwards
query string by wrapping them in forward-slashes ("/") count:[10 TO *]
name:/joh?n(ath[oa]n)/
Grouping Dates before 2012
date:{* TO 2012-01-01}
Multiple terms or clauses can be grouped together
with parentheses, to form sub-queries: Numbers from 1 up to but not including 5
(quick OR brown) AND fox count:[1 TO 5}
Groups can be used to target a particular field, or to Boolean operators
boost the result of a sub-query:
status:(active OR pending) title:(full text
+ (this term must be present) and - (this term must not
search)^2
be present)
All other terms are optional
quick brown +fox -news
