ElasticSearch tips

A page listing random tips for running and understanding ElasticSearch.

Reading queries from files

Having to write the query on the command line quickly becomes very difficult! It's easier to put the query body (as JSON) in a file, and give the remaining arguments in the command-line call to curl.

To then read the query from a file, use the --data-binary "@filename" syntax (--data-binary preserves newlines, compared to --data). You must also set the content-type to JSON, or it will not be understood.

For example:

curl "localhost:9200/oracc/_validate/query" -XGET --data-binary "@es_query" -H "Content-Type: application/json"

Explaining queries

ES has a _validate endpoint, which checks whether a query is valid or not. It also accepts an explain parameter, which, if true, will give a description of what (Lucene?) query is actually being run. This can be very helpful when experimenting with different query types or parameters.

For example, if the file es_query contains the query description:

{
  "query": {
    "bool": {
        "should": [
            {
                "multi_match": {
                    "query": "cyrus",
                    "fields": ["cf", "gw"],
                    "type": "phrase_prefix"
                }
            },
            {
                "multi_match": {
                    "query": "cylinder",
                    "fields": ["cf", "gw"],
                    "type": "phrase_prefix"
                }
            }
        ]
    }
  }
}

then running (see section above for parameter details)

curl "localhost:9200/oracc/_validate/query?explain=true&pretty" -XGET --data-binary "@es_query" -H "Content-Type: application/json"

will give:

{
  "valid" : true,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "failed" : 0
  },
  "explanations" : [
    {
      "index" : "oracc",
      "valid" : true,
      "explanation" : "(gw:\"cyrus*\" | cf:\"cyrus*\") (gw:\"cylinder*\" | cf:\"cylinder*\")"
    }
  ]
}

Further notes:

• The endpoint also accepts the pretty parameter so the response can be pretty-printed (as with other endpoints).
• The URL must be quoted because of the &!