Elasticsearch Query Builder

The bool query is the primary way to combine multiple queries in Elasticsearch. It has four clauses: must (all must match, contributes to score), should (at least one should match, boosts score), filter (must match but does not affect score — cached), and must_not (must not match — cached).

Both require documents to match, but filter skips relevance scoring and is cached by Elasticsearch, making it significantly faster for repeated queries. Use filter for structured data like status, date ranges, and IDs. Use must for full-text search where relevance matters.

Use term for exact value matching on keyword fields (IDs, status codes, tags). term is not analyzed — it compares exact values. Use match for full-text search on analyzed text fields (titles, descriptions) — it applies the same analyzer as the indexed field and splits the query into tokens.

Wildcard queries support * (any number of characters) and ? (single character) patterns, similar to SQL LIKE. Use them for prefix matching (log_*) or flexible string patterns. Avoid leading wildcards (*pattern) as they require scanning all terms and are very slow.

Range queries support gte (>=), lte (<=), gt (>), lt (<), and format parameters. They work on numeric fields, dates, and strings. Date ranges accept ISO 8601 format (2024-01-01) or relative expressions like now-7d/d (7 days ago, rounded to day).

No. All query building happens entirely in your browser. Nothing is sent to any server.