Advanced Features

Advanced search capabilities including multi-search, sorting, pagination, and source filtering.

Sorting and Pagination

Sorting

Sort results by one or more fields:

{
  "query": {"match_all": {}},
  "sort": [
    {"@timestamp": {"order": "desc"}},
    {"response_time": {"order": "asc"}}
  ]
}

Sort by score:

{
  "sort": [
    "_score"
  ]
}

Pagination

From/Size Pagination

Standard pagination using offset and limit:

{
  "query": {"match_all": {}},
  "from": 20,
  "size": 10
}

tip

For large offsets (deep pagination), search_after is more efficient than from/size.

Search After

Efficient pagination for large result sets and deep pagination:

{
  "query": {"match_all": {}},
  "size": 10,
  "sort": [{"@timestamp": "desc"}],
  "search_after": ["2024-01-01T12:00:00Z"]
}

Source Filtering

Control which fields are returned:

{
  "query": {"match_all": {}},
  "_source": ["message", "@timestamp", "user.name"]
}

Include/exclude patterns:

{
  "query": {"match_all": {}},
  "_source": {
    "includes": ["user.*", "message"],
    "excludes": ["user.password", "*.internal"]
  }
}

Disable source:

{
  "query": {"match_all": {}},
  "_source": false
}

Multi-Search Operations

Execute multiple search requests in a single API call for improved performance.

Basic Multi-Search

POST /_msearch
Content-Type: application/x-ndjson

{"index": "logs-2024"}
{"query": {"match": {"level": "error"}}}
{"index": "metrics-2024"}
{"query": {"range": {"@timestamp": {"gte": "now-1h"}}}}

Multi-Search with Different Parameters

POST /_msearch
Content-Type: application/x-ndjson

{"index": "logs", "preference": "_local"}
{"query": {"term": {"status": "error"}}, "size": 5}
{"index": "logs"}
{"query": {"match_all": {}}, "aggs": {"status_count": {"terms": {"field": "status"}}}}

Response format:

{
  "responses": [
    {
      "took": 5,
      "hits": {
        "total": {"value": 42},
        "hits": [/* search results */]
      }
    },
    {
      "took": 3,
      "aggregations": {
        "status_count": {
          "buckets": [/* aggregation results */]
        }
      }
    }
  ]
}

Error Handling in Multi-Search

Individual queries can fail without affecting others:

{
  "responses": [
    {
      "error": {
        "type": "index_not_found_exception",
        "reason": "no such index [missing-index]"
      }
    },
    {
      "took": 2,
      "hits": {
        "total": {"value": 100},
        "hits": []
      }
    }
  ]
}

Common Parameters

Request-Level Parameters

Parameter	Type	Default	Description
size	integer	10	Number of hits to return (max: 10000)
from	integer	0	Starting offset for pagination
timeout	string	-	Request timeout (e.g., "30s", "1m")
terminate_after	integer	-	Stop after finding N documents
track_total_hits	boolean	true	Whether to track total hit count accurately

Query-Level Parameters

Parameter	Type	Description
boost	float	⚠️ Query boost (accepted but ignored in Infino)
_name	string	Query name for debugging

Field Types and Indexing

Different field types support different query types:

Field Type	Analysis	Best Used For	Supported Queries
Text	Analyzed	Full-text search	match, match_phrase, query_string
Keyword	Not analyzed	Exact matching, filtering	term, terms, prefix, wildcard
Numeric	Not analyzed	Ranges, calculations	range, term, aggregations
Date	Not analyzed	Time-based queries	range, date_histogram
Geo	Specialized	Location-based search	geo_distance, geo_bounding_box
Vector	Specialized	AI/ML similarity search	knn

Best Practices

Performance Tips

1. Use filters over queries when you don't need scoring
2. Limit aggregation cardinality to avoid memory issues
3. Use composite aggregations for large cardinality groupings
4. Pre-filter with range queries before expensive operations
5. Use search_after for large offset pagination (more efficient than from/size for deep pagination)

Query Optimization

1. Combine filters in bool queries for better caching
2. Use term queries for exact matches instead of match
3. Avoid leading wildcards in wildcard queries
4. Use exists queries to check for field presence
5. Structure bool queries with filter context when possible