Bool query (must, should, must_not, filter) in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of a Bool query with must and should clauses

Given the following Elasticsearch bool query, what documents will match?

{
  "query": {
    "bool": {
      "must": [
        { "term": { "status": "active" } }
      ],
      "should": [
        { "term": { "role": "admin" } },
        { "term": { "role": "user" } }
      ],
      "minimum_should_match": 1
    }
  }
}

Assuming documents have fields status and role, which option best describes the matching documents?

Elasticsearch

{
  "query": {
    "bool": {
      "must": [
        { "term": { "status": "active" } }
      ],
      "should": [
        { "term": { "role": "admin" } },
        { "term": { "role": "user" } }
      ],
      "minimum_should_match": 1
    }
  }
}

A Documents with status 'active' and role 'admin' and 'user' simultaneously.

B Documents with role 'admin' or 'user' only, regardless of status.

C Documents with status 'active' and role either 'admin' or 'user'.

D Documents with status 'active' or role 'admin' or 'user'.

💡 Hint

Remember that must means all conditions must be true, and should means at least one should match if minimum_should_match is set.

The must clause requires documents to have status equal to 'active'. The should clause requires at least one of the roles 'admin' or 'user' to match because minimum_should_match is 1. So documents must have status 'active' and role either 'admin' or 'user'.

❓ Predict Output

intermediate

Effect of must_not clause in Bool query

What documents will match this Elasticsearch bool query?

{
  "query": {
    "bool": {
      "must": [
        { "term": { "category": "books" } }
      ],
      "must_not": [
        { "term": { "author": "unknown" } }
      ]
    }
  }
}

Elasticsearch

{
  "query": {
    "bool": {
      "must": [
        { "term": { "category": "books" } }
      ],
      "must_not": [
        { "term": { "author": "unknown" } }
      ]
    }
  }
}

A Documents with category 'books' and author 'unknown' only.

B Documents with author 'unknown' only.

C Documents in category 'books' or author 'unknown'.

D Documents in category 'books' excluding those with author 'unknown'.

💡 Hint

The must_not clause excludes documents matching its conditions.

The must clause requires documents to be in category 'books'. The must_not clause excludes documents where author is 'unknown'. So the result is documents in 'books' category but not authored by 'unknown'.

🔧 Debug

advanced

Identify the error in this Bool query with filter

What error will this Elasticsearch query produce?

{
  "query": {
    "bool": {
      "filter": {
        "term": { "status": "active" }
      },
      "must": [
        { "term": { "role": "admin" } }
      ]
    }
  }
}

Elasticsearch

{
  "query": {
    "bool": {
      "filter": {
        "term": { "status": "active" }
      },
      "must": [
        { "term": { "role": "admin" } }
      ]
    }
  }
}

A Syntax error because filter must be an array, not an object.

B No error; query runs and matches documents with status 'active' and role 'admin'.

C Runtime error because 'filter' cannot be combined with 'must'.

D Query returns no results because 'filter' overrides 'must'.

💡 Hint

Check the Elasticsearch documentation for filter clause format.

The filter clause can be an object or an array of queries. Here it is a single term query, which is valid. It works together with must to filter documents with status 'active' and role 'admin'. No error occurs.

📝 Syntax

advanced

Which Bool query syntax is correct?

Which of the following Bool queries is syntactically correct in Elasticsearch?

A { "bool": { "must": [ { "term": { "field": "value" } } ] } }

B { "bool": { "must": { "terms": { "field": ["value1", "value2"] } } } }

C { "bool": { "must": { "term": { "field": "value" } } } }

D { "bool": { "must": [ { "terms": { "field": "value1" } } ] } }

💡 Hint

The must clause expects an array of queries.

Option A correctly uses an array for must with a valid term query object inside. Option A uses an object instead of an array. Option A uses terms without a field key properly structured (missing field key). Option A uses terms with a single string instead of an array.

🚀 Application

expert

Construct a Bool query to find documents with complex conditions

You want to find documents that meet all these conditions:

• Have status equal to 'published'.
• Either category is 'technology' or tags contain 'innovation'.
• Must not have author equal to 'anonymous'.
• Filter to only include documents with views greater than 1000.

Which Bool query JSON correctly implements these conditions?

A

{
  "bool": {
    "must": [
      { "term": { "status": "published" } },
      { "bool": {
          "should": [
            { "term": { "category": "technology" } },
            { "term": { "tags": "innovation" } }
          ],
          "minimum_should_match": 1
        }
      }
    ],
    "must_not": [
      { "term": { "author": "anonymous" } }
    ],
    "filter": [
      { "range": { "views": { "gt": 1000 } } }
    ]
  }
}

B

{
  "bool": {
    "must": [
      { "term": { "status": "published" } },
      { "term": { "category": "technology" } },
      { "term": { "tags": "innovation" } }
    ],
    "must_not": [
      { "term": { "author": "anonymous" } }
    ],
    "filter": {
      "range": { "views": { "gt": 1000 } }
    }
  }
}

C

{
  "bool": {
    "must": [
      { "term": { "status": "published" } }
    ],
    "should": [
      { "term": { "category": "technology" } },
      { "term": { "tags": "innovation" } }
    ],
    "must_not": [
      { "term": { "author": "anonymous" } }
    ],
    "filter": {
      "range": { "views": { "gt": 1000 } }
    },
    "minimum_should_match": 1
  }
}

D

{
  "bool": {
    "must": [
      { "term": { "status": "published" } },
      { "bool": {
          "must": [
            { "term": { "category": "technology" } },
            { "term": { "tags": "innovation" } }
          ]
        }
      }
    ],
    "must_not": [
      { "term": { "author": "anonymous" } }
    ],
    "filter": {
      "range": { "views": { "gt": 1000 } }
    }
  }
}

💡 Hint

Use should with minimum_should_match for OR conditions inside must.

Option A correctly uses a nested bool with should and minimum_should_match inside the must array to express the OR condition between category and tags. It also uses must_not to exclude author 'anonymous' and a filter with a range query for views > 1000. Other options either require both category and tags (B and D) or put should at the top level without nesting inside must (C), which changes the logic.