About Elasticsearch Query Builder

Build Elasticsearch queries with filters and aggregations. Part of the DevTools Surf developer suite. Browse more tools in the Database Tools collection.

Use Cases

• Build full-text search queries with relevance scoring and field boosts
• Construct log analysis queries with time range filters and aggregations
• Design faceted search with term, range, and histogram aggregations
• Test multi-match queries for search-as-you-type autocomplete

Tips

• Use the query DSL builder to construct bool queries with must, should, must_not, and filter clauses — the filter context (filter/must_not) is faster because it is cached and does not score
• Add aggregations in the aggs panel to get bucket counts, histograms, and metric aggregations alongside the search results
• Use the index mapping panel to define field types — keyword fields for exact matching, text fields for full-text search with analysis

Fun Facts

• Elasticsearch was created by Shay Banon in 2010 as a wrapper around Apache Lucene. His first version was actually called Compass (2004), built to help his wife search cooking recipes. The rename to Elasticsearch and rewrite as a distributed search engine came later.
• Elasticsearch is the 'E' in the ELK stack (Elasticsearch, Logstash, Kibana) — one of the most widely adopted open-source observability platforms. The stack was rebranded to 'Elastic Stack' in 2016 when Beats was added as a data shipper.
• Elasticsearch changed its licensing from Apache 2.0 to SSPL (Server Side Public License) in January 2021 — a move that prompted AWS to fork the project as OpenSearch in April 2021, maintaining the Apache 2.0 license for the fork.

FAQ

What is the difference between a query context and a filter context?

Query context (must, should) calculates a relevance score for each matching document. Filter context (filter, must_not) only determines yes/no match without scoring — it is faster and cached. Use filter context for exact-match conditions (date ranges, status fields) and query context for full-text search.

What is an inverted index?

An inverted index maps each unique term to the list of documents containing it — the reverse of a document-to-content index. This enables O(1) lookup of which documents contain a search term, making full-text search fast. Lucene (and Elasticsearch) use inverted indexes as their core data structure.

When should I use Elasticsearch vs PostgreSQL full-text search?

Elasticsearch handles large-scale search (millions of documents), complex relevance tuning, distributed search across shards, and analytics aggregations. PostgreSQL full-text search (tsvector) is sufficient for small-medium datasets and avoids operational complexity. Choose based on scale and feature requirements.