Skip to main content

Full-Text Queries

Full-text queries are analyzed and designed for searching text content. They understand natural language and can match similar terms.

Match Query​

The standard query for performing full-text searches. Analyzes the query text and searches for documents containing any of the resulting terms.

{
  "query": {
    "match": {
      "message": "error database connection"
    }
  }
}

Match query with operator:

{
  "query": {
    "match": {
      "message": {
        "query": "error database connection",
        "operator": "and"
      }
    }
  }
}

Supported parameters:

  • query - The text to search for
  • operator - "and" or "or" (default: "or")
  • analyzer - ⚠️ Accepted but ignored
  • boost - ⚠️ Accepted but ignored

Match All Query​

Returns all documents in the index. Commonly used as a starting point when you want to retrieve all documents, often combined with filters or aggregations.

{
  "query": {
    "match_all": {}
  }
}

Match Phrase Query​

Returns documents that contain an exact phrase in the specified order. The terms must appear consecutively and in the same sequence as provided in the query.

{
  "query": {
    "match_phrase": {
      "message": "database connection error"
    }
  }
}

Match Phrase Prefix Query​

Similar to match_phrase but allows partial matching on the final term. The last term is treated as a prefix, making it useful for search-as-you-type functionality.

{
  "query": {
    "match_phrase_prefix": {
      "message": "database conn"
    }
  }
}

Query String Query​

Returns documents based on a query string using Lucene query syntax. Supports field-specific searches, boolean operators, wildcards, and complex query combinations.

{
  "query": {
    "query_string": {
      "query": "status:error AND message:database*"
    }
  }
}

Advanced query string:

{
  "query": {
    "query_string": {
      "query": "(error OR warning) AND database",
      "default_field": "message",
      "default_operator": "AND"
    }
  }
}