Understanding Elasticsearch DSL Query Syntax (7.x)

For beginners, Elasticsearch DSL (Domain Specific Language) queries can appear confusing due to nested statements; this article summarizes the most common keywords and query structures for version 7.x, helping readers learn and memorize the syntax.

Key keywords include query (similar to SQL SELECT), aggs (SQL GROUP BY), highlight (highlight matched fields), sort (SQL ORDER BY), from / size (SQL LIMIT), and post_filter (post‑aggregation filtering).

Example mapping (showing field types) demonstrates how keyword and text fields are indexed:

{
  "mappings": {
    "properties": {
      "age": { "type": "long" },
      "country": { "type": "keyword", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } },
      "name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }
    }
  }
}

When indexing, a keyword field stores the exact value (e.g., "America"), while a text field is tokenized and lower‑cased (e.g., "Rain" becomes "rain"). Queries match against these inverted indexes.

Query types :

match : full‑text query, tokenizes input and matches lower‑cased terms.

match_phrase : phrase query, requires exact token order and adjacency.

term : exact term query, no analysis.

terms : matches any of multiple exact terms.

exists : filters documents where a field is present.

range : numeric or date range (similar to SQL BETWEEN).

ids : fetches documents by a list of IDs.

fuzzy : fuzzy matching with configurable edit distance, prefix length, max expansions, and transpositions.

Examples:

{
  "query": { "match": { "name": "比尔盖茨" } }
}

{
  "query": { "match_phrase": { "country": "中国" } }
}

{
  "query": { "term": { "country": "America" } }
}

{
  "query": { "range": { "age": { "lte": 50, "gte": 20 } } }
}

{
  "query": { "fuzzy": { "name": { "value": "fain", "fuzziness": 1, "prefix_length": 0, "max_expansions": 50, "transpositions": true } } }
}

Composite (bool) queries allow nesting of leaf queries. The four bool clauses are:

must : documents must satisfy the clause and contribute to scoring.

must_not : documents must not satisfy the clause.

should : documents that satisfy the clause are optional; at least one should match unless minimum_should_match is set.

filter : documents must satisfy the clause but it does not affect scoring; filters are cached for efficiency.

Understanding these building blocks enables the construction of powerful and efficient Elasticsearch queries.