Elasticsearch API Support

Elasticsearch API Support

📘

_msearch - v7.4.2

Query Clauses

Smallest useful _msearch body

{
  "query": {
    "match_all": {
    }
  }
}

Return no hits

Useful for aggregation queries

{
  "size": 0
}

Bool

Bool fields are: must, must_not, should, filter (all fields are optional)

{
  "bool": {
    "must": [{
      "match_all": {
      }
    }],
    "must_not": [],
    "should": {
      "match_all": {
      }
    },
    "filter": []
  }
}

Fields can be provided as a single element or an array

MatchPhrase

Takes a search string and performs a full text search against the given field

{ 
  "match_phrase": {
    "field": "fieldName",
    "query": "search string"
  }
}

MatchPhrase accepts numbers

{
  "match_phrase": {
    "field": "fieldName",
    "query": 123.456
  }
}

MatchPhrase accepts null

{
  "match_phrase": {
    "field": "fieldName",
    "query": null
  }
}

MatchPhrase and other basic query clauses also accept a nested form

{
  "match_phrase": {
    "fieldName": {
    "query": "search string"
    }
  }
}

Match

Performs a match

{
  "match": {
    "field": "fieldName",
    "query": "search string"
  }
}

Also can filter on IP ranges by CIDR form (ex. 10.0.0.0/12)

{
  "match": {
    "field": "fieldName",
    "query": “CIDR-Range-Format”
  }
}

MultiMatch

Performs a match across many fields

{
  "multi_match": {
    "fields": ["field1", "field2"],
    "query": "search string"
  }
}

… also accepts just one field

{
  "multi_match": {
    "fields": "field1",
    "query": "search string"
  }
}

Term

Performs exact matching

{
  "term": {
    "field": "fieldName",
    "query": "keyword"
  }
}

Range

Range has two forms.

This form takes gt[e] and lt[e] as parameters.

{
  "range": {
    "timeField": {
      "gte": "2020-Aug-21",
      "lt": "2020-Sep-1" 
    }
  }
}

This form takes to and from as the value parameters, with include_upper and input_lower to specify in- or exclusive bounds.

{
  "range": {
    "timeField": {
      "from": "2020-Aug-21",
      "include_lower": true,
      "to": "2020-Sep-1"
    }
  }
}

Exists

Checks existence of a field in each row

{
  "exists": {
    "field": "fieldName"
  }
}

QueryString

Accepts the Lucene query syntax

{
  "query_string": {
    "query": "field1:A or field2:B"
  }
}

Regular Expression

Performs a regex search

{
  "regexp": {
    "field": "fieldName",
    "query": "[a-z]+"
  }
}

Fuzzy Search

Matches anything within the given edit distance

{
  "fuzzy": {
    "field": "fieldName",
    "query": "typo",
    "fuzziness": 1
  }
}

Geo Bounding Box

Matches anything within the given Geographic Box

{
  "geo_bounding_box": {
     "DestLocation": {
       "top_left": {
         "lat": Latitude,
         "lon": Longitude
       },
       "bottom_right": {
         "lat": Latitude,
         "lon": Longitude
      }
    }
  }
}

Geo Polygon

Matches anything within the given Geographic Polygon (i.e represent polygon by gving all vertex points)

{
  "geo_polygon": {
  "ignore_unmapped": true,
  "DestLocation": {
    "points": [
      {
        "lat": Latitude,
        "lon": Longitude
      },
      {
        "lat": Latitude,
        "lon": Longitude
      }, ...
    ]
  }
 }
}

Bucket Aggregations

Terms

Creates a bucket for each unique value in field up to a size limit

{
  "aggregationName": {
    "terms": {
      "field": "fieldName",
      "size": 20
    }
  }
}

Accepts a sort order, this is the default: descending on bucket document count

{
  "aggregationName": {
    "terms": {
      "field": "fieldName",
      "size": 20,
      "order": {
        "_count": "desc"
      }
    }
  }
}

Another sort example, this time ascending based on field values

{
  "aggregationName": {
    "terms": {
      "field": "fieldName",
      "size": 20,
      "order": {
        "_term": "asc"
      }
    }
  }
}

Date Histogram

Buckets based on time intervals, specified in a human friendly format

{
  "aggregationName": {
    "date_histogram": {
      "field": "fieldName",
      "interval": "3w"
    }
  }
}

Optionally accepts bounds which will always be present (with empty / default values) even if no documents are present in them

{
  "aggregationName": {
    "date_histogram": {
      "field": "fieldName",
      "interval": "3w",
      "extended_bounds": {
        "min": "2020",
        "max": "2021"
      }
    }
  }
}

Histogram

Buckets based on numeric intervals

{
  "aggregationName": {
    "histogram": {
      "field": "fieldName",
      "interval": 100
    }
  }
}

IP Range

Buckets based on IP Ranges (multiple ranges formatted as {from, to} or {mask}
(i.e 46.0.0.0/2)

{
  "aggregationName": {
    "ip_range": {
       "field": "fieldName",
       "ranges": [
         {
           "from": "0.0.0.0",
           "to": "127.255.255.255"
         },
         {
           "mask": "CIDR-Range-Format"}
       ]
     }
  }
}

GeoHash

Buckets based on GeoHash

{
  "aggregationName": {
    "geohash_grid": {
      "field": "fieldName",
      "precision": [1-12]
    }
  }
}

Metric Aggregations

Average

Metric aggregations can be nested

{
  "aggregationName": {
    "terms": {
      "field": "fieldName",
      "size": 20
    },
    "metricAggregation": {
      "avg": "fieldName"
    }
  }
}

… or top-level

{
  "metricAggregation": {
    "avg": {
      "field": "fieldName"
    }
  }
}

Maximum

{
  "metricAggregation": {
    "max": {
      "field": "fieldName"
    }
  }
}

Minimum

{
  "metricAggregation": {
    "min": {
      "field": "fieldName"
    }
  }
}

Sum

{
  "metricAggregation": {
    "sum": {
      "field": "fieldName"
    }
  }
}

Cardinality

A HyperLogLog estimation

{
  "metricAggregation": {
    "cardinality": {
      "field": "fieldName"
    }
  }
}

Updated about a month ago

Elasticsearch API Support


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.