First search query in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Elasticsearch query?

Given the following Elasticsearch query, which option correctly describes what it returns?

Elasticsearch

{
  "query": {
    "match": {
      "message": "error"
    }
  }
}

A The query returns documents containing the word 'error' or 'warning'.

B The query returns all documents regardless of content.

C The query returns all documents containing the word 'error' in the 'message' field.

D The query returns documents containing the exact phrase 'error' only.

💡 Hint

Think about what the match query does in Elasticsearch.

The match query searches for documents that contain the word 'error' in the specified field. It does not require an exact phrase match and does not include other words like 'warning'.

🧠 Conceptual

intermediate

Which option correctly describes the purpose of the 'size' parameter in a search query?

In an Elasticsearch search query, what does the size parameter control?

A It controls the number of documents returned in the search results.

B It controls the maximum size of each document returned.

C It controls the number of shards to search.

D It controls the timeout duration for the query.

💡 Hint

Think about what you want to limit when you get search results.

The size parameter limits how many documents Elasticsearch returns in the search results. It does not affect document size or shards.

❓ Predict Output

advanced

What is the output of this Elasticsearch query with a filter?

Consider this query. What documents will it return?

Elasticsearch

{
  "query": {
    "bool": {
      "must": {
        "match": { "status": "active" }
      },
      "filter": {
        "range": { "age": { "gte": 30 } }
      }
    }
  }
}

A Documents where 'status' contains 'active' or 'age' is 30 or more.

B Documents where 'status' contains 'active' and 'age' is 30 or more.

C Documents where 'status' contains 'active' but 'age' is less than 30.

D Documents where 'age' is 30 or more regardless of 'status'.

💡 Hint

Remember how bool queries combine must and filter.

The bool query requires both conditions: the must clause matches documents with 'status' containing 'active', and the filter clause restricts to documents with 'age' greater or equal to 30.

🔧 Debug

advanced

What error does this Elasticsearch query produce?

Look at this query. What error will Elasticsearch return?

Elasticsearch

{
  "query": {
    "match": {
      "message": ["error", "failure"]
    }
  }
}

A The query runs successfully and matches documents containing either 'error' or 'failure'.

B The query returns no results because the list is empty.

C Elasticsearch throws a <code>type_error</code> because 'message' field is missing.

D Elasticsearch throws a <code>parsing_exception</code> because the 'match' query expects a string, not a list.

💡 Hint

Check the expected data type for the 'match' query value.

The match query expects a single string value. Passing a list causes a parsing_exception error.

🚀 Application

expert

How many documents are returned by this complex query?

Given this Elasticsearch query, how many documents will be returned if the index contains 100 documents where 40 have 'status' as 'active', 30 have 'age' ≥ 30, and 20 have both conditions?

Elasticsearch

{
  "query": {
    "bool": {
      "should": [
        { "match": { "status": "active" } },
        { "range": { "age": { "gte": 30 } } }
      ],
      "minimum_should_match": 1
    }
  }
}

A 50 documents

B 70 documents

C 100 documents

D 90 documents

💡 Hint

Use the formula for union of two sets: |A| + |B| - |A ∩ B|.

The query uses a bool query with should clauses and minimum_should_match: 1, which acts as an OR condition. It matches documents where 'status' contains 'active' (40 docs) OR 'age' ≥ 30 (30 docs), with 20 docs satisfying both. Total unique matching documents: 40 + 30 - 20 = 50.

Practice

1.

What does a match query do in an Elasticsearch search?

easy

A. It finds documents where the specified field contains the search text.

B. It deletes documents matching the search text.

C. It updates documents with the search text.

D. It creates a new index with the search text.

Solution

1. Step 1: Understand the purpose of match query

   The match query is used to find documents where a field contains the given text.

2. Step 2: Differentiate from other operations

   Deleting, updating, or creating indexes are different Elasticsearch operations, not done by match.

3. Final Answer:

   It finds documents where the specified field contains the search text. -> Option A

4. Quick Check:

   match query = find documents [OK]

Hint: Match query searches text in fields, not modify data [OK]

Common Mistakes:

• Confusing search with delete or update operations
• Thinking match creates or modifies indexes
• Assuming match returns all documents regardless of content

2.

Which of the following is the correct syntax for a basic Elasticsearch match query to search for "apple" in the field "fruit"?

{
  "query": {
    "match": {
      "fruit": "apple"
    }
  }
}

easy

A. { "query": { "match": { "fruit": "apple" } } }

B. { "match": { "query": { "fruit": "apple" } } }

C. { "query": { "fruit": { "match": "apple" } } }

D. { "query": { "match": { "apple": "fruit" } } }

Solution

1. Step 1: Identify the correct JSON structure for a match query

   The correct structure places match inside query, with the field name as key and search text as value.

2. Step 2: Compare options to this structure

   { "query": { "match": { "fruit": "apple" } } } matches the correct syntax exactly. Others misplace keys or swap field and text.

3. Final Answer:

   { "query": { "match": { "fruit": "apple" } } } -> Option A

4. Quick Check:

   Correct JSON structure = { "query": { "match": { "fruit": "apple" } } } [OK]

Hint: Match query is inside query, field name as key, text as value [OK]

Common Mistakes:

• Swapping field name and search text
• Placing match outside query
• Using wrong nesting of JSON keys

3.

Given this Elasticsearch query, what will it search for?

{
  "query": {
    "match": {
      "title": "quick brown fox"
    }
  }
}

medium

A. Documents where the title field contains the exact phrase "quick brown fox".

B. Documents where the title field contains only the word "fox".

C. Documents where the title field is empty.

D. Documents where the title field contains any of the words "quick", "brown", or "fox".

Solution

1. Step 1: Understand how match query works with multiple words

   The match query analyzes the text and searches for documents containing any of the words, not necessarily the exact phrase.

2. Step 2: Compare options with this behavior

   Documents where the title field contains any of the words "quick", "brown", or "fox". correctly states it searches for any of the words. Documents where the title field contains the exact phrase "quick brown fox". is phrase match, which requires a different query type.

3. Final Answer:

   Documents where the title field contains any of the words "quick", "brown", or "fox". -> Option D

4. Quick Check:

   match = any word match [OK]

Hint: Match finds any word in text, not exact phrase [OK]

Common Mistakes:

• Thinking match does exact phrase search
• Assuming match finds only one word
• Confusing match with match_phrase query

4.

Identify the error in this Elasticsearch query:

{
  "query": {
    "match": {
      "content": apple
    }
  }
}

medium

A. The match query should be outside the query object.

B. The field name content should be in quotes.

C. The search text apple should be in quotes.

D. The query object is missing a closing brace.

Solution

1. Step 1: Check JSON syntax for values

   In JSON, string values must be enclosed in double quotes. Here, apple is unquoted.

2. Step 2: Verify other parts of the query

   The field name and braces are correctly quoted and closed. The match query is correctly inside query.

3. Final Answer:

   The search text apple should be in quotes. -> Option C

4. Quick Check:

   Strings need quotes in JSON [OK]

Hint: Always quote string values in JSON queries [OK]

Common Mistakes:

• Leaving string values unquoted
• Misplacing match outside query
• Forgetting closing braces

5.

You want to find documents where the field "description" contains the word "fresh" but only if the field "category" equals "fruit". Which Elasticsearch query correctly combines these conditions?

hard

A. { "query": { "match": { "description": "fresh" }, "match": { "category": "fruit" } } }

B. { "query": { "bool": { "must": [ { "match": { "description": "fresh" } }, { "match": { "category": "fruit" } } ] } } }

C. { "query": { "term": { "description": "fresh" }, "term": { "category": "fruit" } } }

D. { "query": { "match": { "description": "fresh fruit" } } }

Solution

1. Step 1: Understand combining multiple conditions in Elasticsearch

   To require both conditions, use a bool query with must array containing each match query.

2. Step 2: Evaluate each option's structure

   { "query": { "bool": { "must": [ { "match": { "description": "fresh" } }, { "match": { "category": "fruit" } } ] } } } correctly uses bool with must for both matches. { "query": { "match": { "description": "fresh fruit" } } } searches combined text in one field. Options A and C have invalid JSON or incorrect query structure.

3. Final Answer:

   { "query": { "bool": { "must": [ { "match": { "description": "fresh" } }, { "match": { "category": "fruit" } } ] } } } -> Option B

4. Quick Check:

   Use bool must to combine queries [OK]

Hint: Use bool must array to combine multiple match queries [OK]

Common Mistakes:

• Combining terms incorrectly in one match
• Using invalid JSON with repeated keys
• Not using bool query for multiple conditions