Why Match query in Elasticsearch? - Purpose & Use Cases

The Big Idea

Discover how a simple query can save you hours of tedious searching!

The Scenario

Imagine you have a huge pile of documents and you want to find all that mention a certain word or phrase. Doing this by reading each document one by one is like searching for a needle in a haystack by hand.

The Problem

Manually scanning documents is slow and tiring. You might miss some because of typos or different word forms. It's easy to make mistakes and hard to keep track of what you've checked.

The Solution

The match query lets Elasticsearch quickly find documents that contain the words you want, even if they appear in different forms or orders. It does the hard work of understanding and searching text for you.

Before vs After

✗ Before

for doc in documents:
    if 'apple' in doc.text:
        print(doc)

✓ After

{ "query": { "match": { "text": "apple" } } }

What It Enables

It makes searching large text collections fast, flexible, and accurate without manual effort.

Real Life Example

Finding all customer reviews mentioning "great service" quickly, even if they say "great services" or "service was great".

Key Takeaways

Manually searching text is slow and error-prone.

Match query automates and speeds up text search.

It handles variations in words for better results.

Practice

1. What does the match query in Elasticsearch primarily do?

easy

A. Updates documents with new values

B. Finds documents with text similar to the search words

C. Deletes documents matching the query

D. Creates a new index for the documents

Solution

1. Step 1: Understand the purpose of match query

   The match query is designed to find documents that contain text similar to the search words provided.

2. Step 2: Differentiate from other operations

   Deleting, updating, or creating indexes are not functions of the match query; it only searches text.

3. Final Answer:

   Finds documents with text similar to the search words -> Option B

4. Quick Check:

   Match query = text search [OK]

Hint: Match query searches text similarity, not modify data [OK]

Common Mistakes:

• Confusing match query with delete or update operations
• Thinking match query creates indexes
• Assuming match query returns exact matches only

2. Which of the following is the correct syntax for a basic match query in Elasticsearch?

easy

A. { "match": { "field": "search text" } }

B. { "match": "field": "search text" }

C. { "match": { "field" = "search text" } }

D. { "match": [ "field", "search text" ] }

Solution

1. Step 1: Review correct JSON structure for match query

   The match query requires a JSON object with the field name as key and the search text as value inside another object.

2. Step 2: Identify syntax errors in options

   { "match": { "field": "search text" } } uses correct JSON with colon separators and nested object. Options A, B, and C have syntax errors like missing braces, wrong assignment, or array usage.

3. Final Answer:

   { "match": { "field": "search text" } } -> Option A

4. Quick Check:

   Correct JSON syntax = { "match": { "field": "search text" } } [OK]

Hint: Match query uses nested JSON with field: text inside match [OK]

Common Mistakes:

• Using equal sign instead of colon
• Missing curly braces around field and text
• Using array instead of object for field and text

3. Given this Elasticsearch query:

{ "query": { "match": { "title": { "query": "quick brown fox", "operator": "and" } } } }

What does the operator": "and" do in this match query?

medium

A. Returns documents containing all the words 'quick', 'brown', and 'fox'

B. Returns documents containing any of the words 'quick', 'brown', or 'fox'

C. Returns documents containing the exact phrase 'quick brown fox'

D. Returns documents containing none of the words

Solution

1. Step 1: Understand the operator option in match query

   The operator 'and' means all words in the query must be present in the document for a match.

2. Step 2: Compare with other operators

   Operator 'or' would return documents with any word, but 'and' requires all words.

3. Final Answer:

   Returns documents containing all the words 'quick', 'brown', and 'fox' -> Option A

4. Quick Check:

   Operator 'and' = all words required [OK]

Hint: Operator 'and' means all words must appear [OK]

Common Mistakes:

• Confusing 'and' with 'or' operator
• Thinking 'and' means exact phrase match
• Ignoring operator option defaults

4. Identify the error in this match query:

{ "query": { "match": { "content": { "query": "data science", "operator": "AND" } } } }

medium

A. The field name 'content' is invalid

B. The query string must be an array, not a string

C. The operator value should be lowercase 'and', not uppercase 'AND'

D. The match query cannot have an operator option

Solution

1. Step 1: Check operator value case sensitivity

   Elasticsearch expects the operator value to be lowercase 'and' or 'or'. Uppercase 'AND' is invalid.

2. Step 2: Validate other parts of the query

   The field name 'content' is valid, query string can be a string, and match query supports operator option.

3. Final Answer:

   The operator value should be lowercase 'and', not uppercase 'AND' -> Option C

4. Quick Check:

   Operator values are lowercase [OK]

Hint: Operator values must be lowercase 'and' or 'or' [OK]

Common Mistakes:

• Using uppercase 'AND' or 'OR' for operator
• Assuming query must be an array
• Thinking operator option is not allowed

5. You want to find documents where the description field contains either the word 'fast' or 'quick', but not necessarily both. Which match query is correct?

hard

A. { "match": { "description": { "query": "fast quick", "operator": "not" } } }

B. { "match": { "description": { "query": "fast quick", "operator": "and" } } }

C. { "match": { "description": "fast OR quick" } }

D. { "match": { "description": { "query": "fast quick", "operator": "or" } } }

Solution

1. Step 1: Understand the operator 'or' in match query

   Operator 'or' returns documents containing any of the words, so either 'fast' or 'quick' or both.

2. Step 2: Evaluate other options

   B requires both words, C searches for documents containing 'fast', 'OR', and 'quick' (treating OR as literal text), D uses invalid operator 'not'.

3. Final Answer:

   { "match": { "description": { "query": "fast quick", "operator": "or" } } } -> Option D

4. Quick Check:

   Use operator 'or' for any word match [OK]

Hint: Use operator 'or' to match any word in query [OK]

Common Mistakes:

• Using 'and' when 'or' is needed
• Using 'OR' in the search text instead of operator
• Using invalid operator like 'not'