Data is modeled in documents in Elasticsearch. This means a single item irrespective of whether it is an entity like a company, country, or product has to be modeled as a single document. A document can contain any number of fields and values associated with it. This information is modeled around the JSON format that helps us to express the behavior of our data using arrays, objects, or simple values.

Inherently, JSON supports formats such as string, numbers, object, array, and even Boolean. Elasticsearch adds various other formats on top of it, such as the date, IP and so on. You will find the list of such supported types in the following table. The use of date types to store date values will help us do effective date-specific operations, such as date range and aggregation...

The basic idea of a search is to narrow down on a subset of documents that you have. In the Elasticsearch context, this means that based on various conditions, you might want to select a set of documents from an index or a set of index. A query and filter facilitate this for you.

If you have already gone through the reference guide or some other documentation of Elasticsearch, you might have noticed that the same set of operations might be available for both queries and filters. So, what are the differentiating factors of a query and filter even when the set of operations given by them are almost the same? Let's find out.

In a query, a matched document can be a better match than another matched document. In a filter, all the matched documents are treated equally.

This means that there is a way to score or rank a document matched against a query to another document match. This is done by computing a score value that tells you how good a match a particular...

To search we use a large set of documents and our interest here lies only in a subset of this document set. This can be based on a set of constraints and conditions. A search does not stop here. You might be interested in getting a snapshot view of your query result. In our case, if the user searches for dell, he/she might be interested in seeing different unique product types and their document count. This is called an aggregation. Through this, we enhance our search experience and make it more explorable. Here, we try to discover various querying options through which we can express our requirement and communicate the same to Elasticsearch.

In our search application, we expose a search box that can be used for a search. We abstract out information about which field is searched or what is the precedence of the fields that we search. Let's see the query types that would be best for this search box.

Next, when I search for Lenovo, I would like to see different product types associated with it. This is more like making a report out of the results, but then, as this makes your data more explorable and easy to understand, it's safe to see this as enhancing search capabilities.

Hence, whenever I search for something, I want to see the following reports on my query results or rather, an aggregate of my results in the following information:

For this, we need to build different aggregations to capture these reports.

The format in which we should provide aggregations is as follows:

{
    "query" : { ….},
    "aggregations" : { 
        "aggregationNameA...

With a fair idea in mind of when to use your filter and when to opt for a query, let's think of some scenarios and see how Elasticsearch enables filtering at its best. Filtering by a date range, prize, or department often pops up in use cases in an e-commerce view. Look at the left-hand side of the following figure:

Checking for new arrivals or selecting an old classic song from a library may need a date-range-based filtering mechanism. Elasticsearch provides inbuilt facilities to do filtering by providing a date range filter. A term filter does the same thing for strings, which can be anything for example, a department or category. A numeric filter filters numerals and can be used for prizes and so on.

This snippet shows how you can implement a date-range-based filtering in Elasticsearch:

{
"query" : 
{ "filtered" :
  { "query" :
    { "text" : { "content" : "any keywords to match" }
  },
 "filter" : 
{ "numeric_range" :
 { "date" :
     { "lt" : ...

Now, let's move on and see how to implement a prize range filter as seen in some e-commerce websites. Consider the following screenshot of an e-commerce site:

In the preceding screenshot, you can see a price range filter on the left-hand side tab. By clicking on or specifying the price ranges, the products that fall within that range would be displayed. This is nothing but a numeric range filter.

The implementation of a numeric range filter is almost similar to the date range filter in Elasticsearch. The following code snippet shows how to implement a numeric range filter. Here is the sample; assume that you have an age field that is numeric in nature:

{
    "filtered" : {
        "filter" : {
            "range" : {
                "age" : {
                    "gte": 10,
                    "lte": 20
                }
            }
        }
    }
}

After reading the implementation of filters, which is to be followed, you would understand the snippet completely...

Normally, the category fields are of the type string. We need to index this unanalyzed field to match the exact term. In fact, Elasticsearch uses a term filter for the purpose of matching strings:

The following snippet shows you how to use a terms filter:

{
    "filtered" : {
        "filter" : {
            "term" : {
                "category" : "Books"
        
            }
        }
    }
}

This section sheds some light on the implementation of filters in Elasticsearch. All filters are not the same. We will see how each one differs from another and how we can implement these with Elasticsearch. First, let's see all the three implementation types of filters in Elasticsearch.

We have already showed you the most basic type of usage of a filter in the previous examples. You would have noticed the term constant score or filtered every time we used a filter. These are queries and they wrap the filter inside and apply it against the normal query's result. This is the first type of filter implementation of Elasticsearch.

Note that the filtered/constant score implementation of filters will affect both the results of the query and aggregations; some of the examples are shown as follows:

curl -XPOST 'http://localhost:9200/products/_search?pretty' -d '{
   "aggregations": {
     "department": {
       "terms": {
         "field": "color"
       ...

Often, we find ourselves in a position where we need to search with more than one criterion, where each of these criteria could be expressed as an individual query. In this section, let's see how we can make such a combination of search.

One simple way to express multiple search criteria is using a bool query. The bool query lets you use a combination of other queries, where each of the conditions can be put using a Boolean clause. There are three Boolean clauses:

The must clause suggests that the constituent query must appear in the matching documents. If there is no must clause in the query, a combination of should clauses can be given. Also, you may set the minimum number of should clauses that should be matched. As the name indicates, must_not means that this clause should not match the document.

Let's see how we can use the bool query in Elasticsearch:

{
    "bool" : {
        "must" : [{
            "term" : { "productType" : ...