Match query in Elasticsearch - Step-by-Step Execution

Concept Flow - Match query

Receive user text input

↓

Analyze text: tokenize, lowercase

↓

Search index for matching tokens

↓

Score documents by relevance

↓

Return ranked results

The match query takes user text, breaks it into words, searches the index for those words, scores documents by relevance, and returns the best matches.

Execution Sample

Elasticsearch

{
  "query": {
    "match": {
      "message": "quick brown fox"
    }
  }
}

This query searches the 'message' field for documents matching the words 'quick brown fox'.

Execution Table

Step	Action	Input/Condition	Result/Output
1	Receive query text	"quick brown fox"	Text ready for analysis
2	Analyze text	Tokenize and lowercase	["quick", "brown", "fox"]
3	Search index	Look for documents with tokens	Documents containing any of the tokens
4	Score documents	Calculate relevance based on token matches	Documents ranked by score
5	Return results	Top ranked documents	List of matching documents shown

💡 All steps complete, results returned to user

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
query_text	"quick brown fox"	"quick brown fox"	"quick brown fox"	"quick brown fox"	"quick brown fox"
tokens	[]	["quick", "brown", "fox"]	["quick", "brown", "fox"]	["quick", "brown", "fox"]	["quick", "brown", "fox"]
matched_docs	[]	[]	["doc1", "doc2", "doc3"]	["doc1(score=3)", "doc2(score=2)", "doc3(score=1)"]	["doc1", "doc2", "doc3"]

Key Moments - 3 Insights

Why does the match query break the input text into tokens?

Because the match query analyzes the text to find individual words (tokens) to search for, as shown in step 2 of the execution_table where the text is tokenized into ["quick", "brown", "fox"].

Does the match query look for the exact phrase 'quick brown fox' or individual words?

It looks for individual words, not the exact phrase. The tokens are searched separately as shown in step 3 where documents containing any of the tokens are found.

How are documents ranked in the match query results?

Documents are scored based on how many tokens they contain and their relevance, as shown in step 4 where documents have scores like 3, 2, and 1.

Visual Quiz - 3 Questions

Look at the execution_table, what tokens are generated after step 2?

A ["quick brown fox"]

B ["quick", "brown", "fox"]

C ["Quick", "Brown", "Fox"]

D []

💡 Hint

Check the 'Result/Output' column in row for step 2 in execution_table

At which step are documents scored by relevance?

A Step 4

B Step 2

C Step 3

D Step 5

💡 Hint

Look at the 'Action' column in execution_table to find scoring step

If the input text was changed to 'lazy dog', how would the tokens in variable_tracker change after step 2?

A ["lazy dog"]

B ["quick", "brown", "fox"]

C ["lazy", "dog"]

D []

💡 Hint

Refer to the 'tokens' row in variable_tracker after step 2

Concept Snapshot

Match query syntax:
{
  "query": { "match": { "field": "text" } }
}

Behavior:
- Analyzes input text into tokens
- Searches for documents containing tokens
- Scores documents by relevance
- Returns ranked results

Key rule: Match query searches words, not exact phrases.

Full Transcript

The match query in Elasticsearch takes the user's input text and breaks it into smaller parts called tokens. These tokens are usually words in lowercase. Then, it searches the index for documents that contain any of these tokens. Each document is scored based on how many tokens it contains and how relevant they are. Finally, the query returns a list of documents ranked by their scores. For example, if the input is 'quick brown fox', the query looks for documents containing 'quick', 'brown', or 'fox' and ranks them accordingly. This process involves analyzing the text, searching, scoring, and returning results step-by-step.

Practice

1. What does the match query in Elasticsearch primarily do?

easy

A. Updates documents with new values

B. Finds documents with text similar to the search words

C. Deletes documents matching the query

D. Creates a new index for the documents

Solution

1. Step 1: Understand the purpose of match query

   The match query is designed to find documents that contain text similar to the search words provided.

2. Step 2: Differentiate from other operations

   Deleting, updating, or creating indexes are not functions of the match query; it only searches text.

3. Final Answer:

   Finds documents with text similar to the search words -> Option B

4. Quick Check:

   Match query = text search [OK]

Hint: Match query searches text similarity, not modify data [OK]

Common Mistakes:

• Confusing match query with delete or update operations
• Thinking match query creates indexes
• Assuming match query returns exact matches only

2. Which of the following is the correct syntax for a basic match query in Elasticsearch?

easy

A. { "match": { "field": "search text" } }

B. { "match": "field": "search text" }

C. { "match": { "field" = "search text" } }

D. { "match": [ "field", "search text" ] }

Solution

1. Step 1: Review correct JSON structure for match query

   The match query requires a JSON object with the field name as key and the search text as value inside another object.

2. Step 2: Identify syntax errors in options

   { "match": { "field": "search text" } } uses correct JSON with colon separators and nested object. Options A, B, and C have syntax errors like missing braces, wrong assignment, or array usage.

3. Final Answer:

   { "match": { "field": "search text" } } -> Option A

4. Quick Check:

   Correct JSON syntax = { "match": { "field": "search text" } } [OK]

Hint: Match query uses nested JSON with field: text inside match [OK]

Common Mistakes:

• Using equal sign instead of colon
• Missing curly braces around field and text
• Using array instead of object for field and text

3. Given this Elasticsearch query:

{ "query": { "match": { "title": { "query": "quick brown fox", "operator": "and" } } } }

What does the operator": "and" do in this match query?

medium

A. Returns documents containing all the words 'quick', 'brown', and 'fox'

B. Returns documents containing any of the words 'quick', 'brown', or 'fox'

C. Returns documents containing the exact phrase 'quick brown fox'

D. Returns documents containing none of the words

Solution

1. Step 1: Understand the operator option in match query

   The operator 'and' means all words in the query must be present in the document for a match.

2. Step 2: Compare with other operators

   Operator 'or' would return documents with any word, but 'and' requires all words.

3. Final Answer:

   Returns documents containing all the words 'quick', 'brown', and 'fox' -> Option A

4. Quick Check:

   Operator 'and' = all words required [OK]

Hint: Operator 'and' means all words must appear [OK]

Common Mistakes:

• Confusing 'and' with 'or' operator
• Thinking 'and' means exact phrase match
• Ignoring operator option defaults

4. Identify the error in this match query:

{ "query": { "match": { "content": { "query": "data science", "operator": "AND" } } } }

medium

A. The field name 'content' is invalid

B. The query string must be an array, not a string

C. The operator value should be lowercase 'and', not uppercase 'AND'

D. The match query cannot have an operator option

Solution

1. Step 1: Check operator value case sensitivity

   Elasticsearch expects the operator value to be lowercase 'and' or 'or'. Uppercase 'AND' is invalid.

2. Step 2: Validate other parts of the query

   The field name 'content' is valid, query string can be a string, and match query supports operator option.

3. Final Answer:

   The operator value should be lowercase 'and', not uppercase 'AND' -> Option C

4. Quick Check:

   Operator values are lowercase [OK]

Hint: Operator values must be lowercase 'and' or 'or' [OK]

Common Mistakes:

• Using uppercase 'AND' or 'OR' for operator
• Assuming query must be an array
• Thinking operator option is not allowed

5. You want to find documents where the description field contains either the word 'fast' or 'quick', but not necessarily both. Which match query is correct?

hard

A. { "match": { "description": { "query": "fast quick", "operator": "not" } } }

B. { "match": { "description": { "query": "fast quick", "operator": "and" } } }

C. { "match": { "description": "fast OR quick" } }

D. { "match": { "description": { "query": "fast quick", "operator": "or" } } }

Solution

1. Step 1: Understand the operator 'or' in match query

   Operator 'or' returns documents containing any of the words, so either 'fast' or 'quick' or both.

2. Step 2: Evaluate other options

   B requires both words, C searches for documents containing 'fast', 'OR', and 'quick' (treating OR as literal text), D uses invalid operator 'not'.

3. Final Answer:

   { "match": { "description": { "query": "fast quick", "operator": "or" } } } -> Option D

4. Quick Check:

   Use operator 'or' for any word match [OK]

Hint: Use operator 'or' to match any word in query [OK]

Common Mistakes:

• Using 'and' when 'or' is needed
• Using 'OR' in the search text instead of operator
• Using invalid operator like 'not'