Bool query (must, should, must_not, filter) in Elasticsearch - Mini Project: Build & Apply

Bool query (must, should, must_not, filter)

📖 Scenario: You are working with an Elasticsearch index of books. Each book has fields like title, author, genre, and year. You want to find books that match certain conditions using a bool query.

🎯 Goal: Build an Elasticsearch bool query using must, should, must_not, and filter clauses to find books that meet specific criteria.

📋 What You'll Learn

Create a bool query JSON with must, should, must_not, and filter clauses

Use exact field names: title, author, genre, year

Use match queries inside must and should

Use term query inside must_not

Use range query inside filter

💡 Why This Matters

🌍 Real World

Bool queries are used in search engines to combine multiple conditions for filtering and scoring search results.

💼 Career

Knowing how to build bool queries is essential for roles involving search, data retrieval, and Elasticsearch administration.

1

Create the base bool query structure

Create a variable called bool_query and set it to a JSON object with an empty bool key containing empty lists for must, should, must_not, and filter.

Elasticsearch

bool_query = {
    "bool": {
        "must": [],
        "should": [],
        "must_not": [],
        "filter": []
    }
}
# Your code here

Hint

Start by creating a dictionary named bool_query with a bool key. Inside bool, add keys must, should, must_not, and filter each set to empty lists.

2

Add a must clause with a match query

Add a match query for author with value "Agatha Christie" inside the must list of bool_query.

Elasticsearch

bool_query = {
    "bool": {
        "must": [],
        "should": [],
        "must_not": [],
        "filter": []
    }
}
# Add a match query for author 'Agatha Christie' inside must

Hint

Inside the must list, add a dictionary with a match key. The value should be another dictionary with author as key and "Agatha Christie" as value.

3

Add should, must_not, and filter clauses

Add a match query for genre with value "mystery" inside the should list. Add a term query for title with value "Twilight" inside the must_not list. Add a range query for year greater than or equal to 1950 inside the filter list of bool_query.

Elasticsearch

bool_query = {
    "bool": {
        "must": [
            {"match": {"author": "Agatha Christie"}}
        ],
        "should": [],
        "must_not": [],
        "filter": []
    }
}
# Add match query for genre 'mystery' in should
# Add term query for title 'Twilight' in must_not
# Add range query for year >= 1950 in filter

Hint

Remember to add one dictionary inside each list: should gets a match for genre, must_not gets a term for title, and filter gets a range for year with gte 1950.

4

Print the final bool query JSON

Print the bool_query variable to display the complete bool query JSON.

Elasticsearch

bool_query = {
    "bool": {
        "must": [
            {"match": {"author": "Agatha Christie"}}
        ],
        "should": [
            {"match": {"genre": "mystery"}}
        ],
        "must_not": [
            {"term": {"title": "Twilight"}}
        ],
        "filter": [
            {"range": {"year": {"gte": 1950}}}
        ]
    }
}
print(bool_query)
# Your code here

Hint

Use print(bool_query) to show the final JSON object.

Practice

1. Which clause in an Elasticsearch bool query is used to exclude documents that match a condition?

easy

A. must

B. must_not

C. should

D. filter

Solution

1. Step 1: Understand bool query clauses

   The bool query has four main clauses: must (required), should (optional), must_not (exclude), and filter (limit without scoring).

2. Step 2: Identify exclusion clause

   The must_not clause excludes documents that match its conditions from the results.

3. Final Answer:

   must_not -> Option B

4. Quick Check:

   Exclude = must_not [OK]

Hint: Exclude with must_not clause in bool query [OK]

Common Mistakes:

• Confusing must_not with must
• Using should to exclude documents
• Thinking filter excludes documents

2. Which of the following is the correct syntax to add a must clause inside a bool query in Elasticsearch?

easy

A. "bool": { "must": [ { "match": { "field": "value" } } ] }

B. "bool": { "must": ( { "match": { "field": "value" } } ) }

C. "bool": { "must": "match": { "field": "value" } }

D. "bool": { "must": { "match": { "field": "value" } } }

Solution

1. Step 1: Recall bool must clause syntax

   The must clause expects an array of query objects inside the bool query.

2. Step 2: Check each option's syntax

   "bool": { "must": [ { "match": { "field": "value" } } ] } correctly uses an array with one match query object. The other options use incorrect types or missing brackets.

3. Final Answer:

   "bool": { "must": [ { "match": { "field": "value" } } ] } -> Option A

4. Quick Check:

   Must clause = array of queries [OK]

Hint: Must clause requires an array of query objects [OK]

Common Mistakes:

• Using object instead of array for must
• Missing brackets around match query
• Using parentheses instead of brackets

3. Given this bool query snippet, which documents will be matched?

{
  "bool": {
    "must": [{ "term": { "status": "active" }}],
    "should": [{ "term": { "role": "admin" }}],
    "must_not": [{ "term": { "banned": true }}]
  }
}

medium

A. Documents with status 'active' and role 'admin', excluding banned ones

B. Documents with status 'active' or role 'admin', including banned ones

C. Documents with role 'admin' only, excluding banned ones

D. Documents with status 'active', optionally role 'admin', excluding banned ones

Solution

1. Step 1: Analyze must clause effect

   The must clause requires documents to have status: active.

2. Step 2: Analyze should and must_not clauses

   The should clause means documents with role: admin are preferred but not required. The must_not clause excludes documents where banned is true.

3. Final Answer:

   Documents with status 'active', optionally role 'admin', excluding banned ones -> Option D

4. Quick Check:

   Must + optional should + exclude must_not = Documents with status 'active', optionally role 'admin', excluding banned ones [OK]

Hint: Must is required, should is optional, must_not excludes [OK]

Common Mistakes:

• Thinking should is required
• Ignoring must_not exclusion
• Confusing must and should roles

4. Identify the error in this bool query:

{
  "bool": {
    "must": { "match": { "title": "Elasticsearch" } },
    "filter": { "term": { "status": "published" } },
    "must_not": [ { "term": { "archived": true } } ]
  }
}

medium

A. "must" should be an array, not an object

B. "filter" cannot be used with "must_not"

C. "must_not" should be an object, not an array

D. The query is correct as is

Solution

1. Step 1: Check must clause format

   The must clause expects an array of query objects, but here it is given as a single object.

2. Step 2: Validate other clauses

   The filter and must_not clauses are correctly formatted as an object and an array respectively.

3. Final Answer:

   "must" should be an array, not an object -> Option A

4. Quick Check:

   Must clause = array required [OK]

Hint: Must clause must always be an array [OK]

Common Mistakes:

• Using object instead of array for must
• Thinking filter and must_not conflict
• Using array for must_not incorrectly

5. You want to find documents where the category is 'books' and the price is less than 20, but exclude those that are out of stock. Which bool query correctly implements this?

hard

A. { "bool": { "should": [ { "term": { "category": "books" } }, { "range": { "price": { "lt": 20 } } } ], "must_not": [ { "term": { "stock": "out" } } ] } }

B. { "bool": { "filter": [ { "term": { "category": "books" } }, { "range": { "price": { "lt": 20 } } } ], "must_not": { "term": { "stock": "out" } } } }

C. { "bool": { "must": [ { "term": { "category": "books" } }, { "range": { "price": { "lt": 20 } } } ], "must_not": [ { "term": { "stock": "out" } } ] } }

D. { "bool": { "must": { "term": { "category": "books" } }, "filter": { "range": { "price": { "lt": 20 } } }, "must_not": [ { "term": { "stock": "out" } } ] } }

Solution

1. Step 1: Identify required conditions

   Documents must have category: books and price < 20. Both are required, so they go in must as an array.

2. Step 2: Exclude out of stock documents

   Documents with stock: out must be excluded, so use must_not with an array of term queries.

3. Step 3: Check each option

   { "bool": { "must": [ { "term": { "category": "books" } }, { "range": { "price": { "lt": 20 } } } ], "must_not": [ { "term": { "stock": "out" } } ] } } correctly uses must array for required conditions and must_not array for exclusion. { "bool": { "filter": [ { "term": { "category": "books" } }, { "range": { "price": { "lt": 20 } } } ], "must_not": { "term": { "stock": "out" } } } } uses filter which is okay but must_not is an object, not array. { "bool": { "should": [ { "term": { "category": "books" } }, { "range": { "price": { "lt": 20 } } } ], "must_not": [ { "term": { "stock": "out" } } ] } } uses should which makes conditions optional, wrong here. { "bool": { "must": { "term": { "category": "books" } }, "filter": { "range": { "price": { "lt": 20 } } }, "must_not": [ { "term": { "stock": "out" } } ] } } uses must as object and filter as object, mixing styles incorrectly.

4. Final Answer:

   { "bool": { "must": [ { "term": { "category": "books" } }, { "range": { "price": { "lt": 20 } } } ], "must_not": [ { "term": { "stock": "out" } } ] } } -> Option C

5. Quick Check:

   Must array + must_not array for exclusion [OK]

Hint: Use must array for required, must_not array to exclude [OK]

Common Mistakes:

• Using should instead of must for required filters
• Using object instead of array for must or must_not
• Mixing filter and must incorrectly