Skip to content

Query String Query

Jump to bottom
ignacio-alorre edited this page May 30, 2019 · 5 revisions

A query that uses a query parser in order to parse its content. Here is an example:

GET /_search
{
    "query": {
        "query_string" : {
            "default_field" : "content",
            "query" : "this AND that OR thus"
        }
    }
}

The query_string query parses the input and splits text around operators. Each textual part is analyzed independently of each other. For instance the following query:

GET /_search
{
    "query": {
        "query_string" : {
            "default_field" : "content",
            "query" : "(new york city) OR (big apple)"
        }
    }
}

Will be split into new york city and big apple and each part is then analyzed independently by the analyzer configured for the field.

Note: Whitespaces are not considered operators, this means that new york city will be passed "as is" to the analyzer configured for the field. If the field is a keyword field the analyzer will create a single term new york city and the query builder will use this term in the query. If you want to query each term separately you need to add explicit operators around the terms (e.g. new AND york AND city).

When multiple fields are provided it is also possible to modify how the different field queries are combined inside each textual part using the type parameter. The possible modes are described here and the default is best_fields.

The query_string top level parameters include:

  • query: The actual query to be parsed. See Query string syntax.

  • default_field: The default field for query terms if no prefix field is specified. Defaults to the index.query.default_field index settings, which in turn defaults to *. * extracts all fields in the mapping that are eligible to term queries and filters the metadata fields. All extracted fields are then combined to build a query when no prefix field is provided.

  • default_operator: The default operator used if no explicit operator is specified. For example, with a default operator of OR, the query capital of Hungary is translated to capital OR of OR Hungary, and with default operator of AND, the same query is translated to capital AND of AND Hungary. The default value is OR.

  • analyzer: The analyzer name used to analyze the query string.

  • quote_analyzer: The name of the analyzer that is used to analyze quoted phrases in the query string. For those parts, it overrides other analyzers that are set using the analyzer parameter or the search_quote_analyzer setting.

  • allow_leading_wildcard: When set, * or ? are allowed as the first character. Defaults to true.

  • enable_position_increments: Set to true to enable position increments in result queries. Defaults to true.

  • fuzzy_max_expansions: Controls the number of terms fuzzy queries will expand to. Defaults to 50

  • fuzziness: Set the fuzziness for fuzzy queries. Defaults to AUTO. See Fuzzinessedit for allowed settings.

  • fuzzy_prefix_length: Set the prefix length for fuzzy queries. Default is 0.

  • phrase_slop: Sets the default slop for phrases. If zero, then exact phrase matches are required. Default value is 0.

  • boost: Sets the boost value of the query. Defaults to 1.0.

  • auto_generate_phrase_queries: Defaults to false.

  • analyze_wildcard: By default, wildcards terms in a query string are not analyzed. By setting this value to true, a best effort will be made to analyze those as well.

  • max_determinized_states: Limit on how many automaton states regexp queries are allowed to create. This protects against too-difficult (e.g. exponentially hard) regexps. Defaults to 10000.

  • minimum_should_match: A value controlling how many "should" clauses in the resulting boolean query should match. It can be an absolute value (2), a percentage (30%) or a combination of both.

  • lenient: If set to true will cause format based failures (like providing text to a numeric field) to be ignored.

  • time_zone: Time Zone to be applied to any range query related to dates. See also JODA timezone.

  • quote_field_suffix: A suffix to append to fields for quoted parts of the query string. This allows to use a field that has a different analysis chain for exact matching. Look here for a comprehensive example.

  • all_fields: [6.0.0] Deprecated in 6.0.0. set default_field to * instead Perform the query on all fields detected in the mapping that can be queried. Will be used by default when the _all field is disabled and no default_field is specified (either in the index settings or in the request body) and no fields are specified.

When a multi term query is being generated, one can control how it gets rewritten using the rewrite parameter.

Default Field

When not explicitly specifying the field to search on in the query string syntax, the index.query.default_field will be used to derive which field to search on. If the index.query.default_field is not specified, the query_string will automatically attempt to determine the existing fields in the index’s mapping that are queryable, and perform the search on those fields. Note that this will not include nested documents, use a nested query to search those documents.

Clone this wiki locally