Query DSL reference

Note

This section provides detailed reference information.

Refer to the Query DSL overview for overview and conceptual information about Query DSL.

Elasticsearch provides a full Query DSL (Domain Specific Language) based on JSON to define queries. You can start with a single clause, such as a match query, and combine clauses into larger queries as your searches grow. Think of the Query DSL as an AST (Abstract Syntax Tree) of queries.

Query clauses fall into two types:

Leaf query clauses
Leaf query clauses look for a particular value in a particular field, such as the match, term or range queries. These queries can be used by themselves.
Compound query clauses
Compound query clauses wrap other leaf or compound queries and are used to combine multiple queries in a logical fashion (such as the bool or dis_max query), or to alter their behaviour (such as the constant_score query).

Query clauses behave differently depending on whether they are used in query context or filter context.

Query DSL groups queries by the kind of search they run. Select a group to compare its queries:

  • Full-text queries: Search analyzed text fields, such as the body of an email.
  • Term-level queries: Find documents based on precise values in structured data, such as date ranges, IP addresses, prices, or product IDs.
  • Compound queries: Combine other queries, change their behavior, or switch from query to filter context.
  • Vector queries: Search vector fields to run semantic search.
  • Geo queries: Search geo_point and geo_shape fields.
  • Shape queries: Search point and shape fields that hold cartesian, non-geospatial data.
  • Joining queries: Query related documents with nested and parent-child joins.
  • Span queries: Control the order and proximity of terms with low-level positional queries.
  • Specialized queries: Use queries that don't fit the other groups.
  • Match all query: Match every document and give each a _score of 1.0.

Certain types of queries generally run slowly because of the way they are implemented, which can affect the stability of the cluster. These queries fall into the following categories:

Elasticsearch runs these queries by default. Whether you can block them depends on your deployment:

You can't block these queries. The search.allow_expensive_queries setting isn't configurable.

To block these queries, set search.allow_expensive_queries to false with the cluster update settings API. This requires the manage cluster privilege. The setting is dynamic, so the change applies without a restart. While it is false, a search that includes one of the listed queries returns an error that names the setting, instead of running.

To learn Query DSL by example, refer to Get started with Query DSL search and filters. To understand how query clauses score and filter documents, refer to Query and filter context.