Why search is Elasticsearch's core purpose - See It in Action

Why Search is Elasticsearch's Core Purpose

📖 Scenario: Imagine you have a large collection of documents, like a library of books or a big list of customer reviews. You want to find specific information quickly, like all books about cooking or reviews mentioning "great service". Elasticsearch helps you do this fast and easily by searching through all your data.

🎯 Goal: You will create a simple Elasticsearch index with some documents, configure a search query, run the search, and see the results. This will show why search is the main reason people use Elasticsearch.

📋 What You'll Learn

Create an Elasticsearch index called library with sample documents

Add a configuration variable for the search term

Write a search query to find documents matching the search term

Print the search results showing matched documents

💡 Why This Matters

🌍 Real World

Elasticsearch is used in many websites and apps to let users quickly find relevant information from large amounts of data.

💼 Career

Knowing how to create indexes and write search queries is essential for roles like data engineer, backend developer, and search specialist.

1

Create the Elasticsearch index with sample documents

Create an Elasticsearch index called library with these exact documents: {"title": "Cooking Basics", "content": "Learn to cook delicious meals."}, {"title": "Gardening Tips", "content": "Grow your own vegetables."}, and {"title": "Travel Guide", "content": "Explore new places around the world."}. Use the index API to add these documents.

Elasticsearch

# Your code here to create index 'library' and add documents

Hint

Use the PUT method to add documents to the library index with IDs 1, 2, and 3.

2

Add a search term variable

Create a variable called search_term and set it to the string "cook". This will be the word you want to find in the documents.

Elasticsearch

PUT /library/_doc/1
{
  "title": "Cooking Basics",
  "content": "Learn to cook delicious meals."
}

PUT /library/_doc/2
{
  "title": "Gardening Tips",
  "content": "Grow your own vegetables."
}

PUT /library/_doc/3
{
  "title": "Travel Guide",
  "content": "Explore new places around the world."
}

# Create a variable called search_term with value "cook"
# Your code here

Hint

Just write search_term = "cook" below the existing code.

3

Write a search query using the search term

Write a search query using the search_term variable to find documents in the library index where the content field matches the search term. Use the match query inside the query object.

Elasticsearch

PUT /library/_doc/1
{
  "title": "Cooking Basics",
  "content": "Learn to cook delicious meals."
}

PUT /library/_doc/2
{
  "title": "Gardening Tips",
  "content": "Grow your own vegetables."
}

PUT /library/_doc/3
{
  "title": "Travel Guide",
  "content": "Explore new places around the world."
}

search_term = "cook"

# Write a search query using match on content with search_term
# Your code here

Hint

Use GET /library/_search with a query object containing match on content with the value of search_term.

4

Print the search results

Print the search results showing the titles of documents that matched the search term "cook". Assume the search response is stored in a variable called response. Use a loop to print each matched document's _source.title.

Elasticsearch

PUT /library/_doc/1
{
  "title": "Cooking Basics",
  "content": "Learn to cook delicious meals."
}

PUT /library/_doc/2
{
  "title": "Gardening Tips",
  "content": "Grow your own vegetables."
}

PUT /library/_doc/3
{
  "title": "Travel Guide",
  "content": "Explore new places around the world."
}

search_term = "cook"

GET /library/_search
{
  "query": {
    "match": {
      "content": "cook"
    }
  }
}

response = {
  "hits": {
    "hits": [
      {"_source": {"title": "Cooking Basics"}}
    ]
  }
}

# Print the titles of matched documents
# Your code here

Hint

Loop over response["hits"]["hits"] and print each _source["title"].

Practice

1. Why is search considered the core purpose of Elasticsearch?

easy

A. Because it is designed to quickly find relevant information in large datasets

B. Because it stores data in relational tables

C. Because it only supports simple keyword matching

D. Because it is mainly used for data visualization

Solution

1. Step 1: Understand Elasticsearch's design goal

   Elasticsearch is built to handle large volumes of data and provide fast search results.

2. Step 2: Identify the main use case

   Its main use is to find relevant information quickly using powerful search queries.

3. Final Answer:

   Because it is designed to quickly find relevant information in large datasets -> Option A

4. Quick Check:

   Core purpose = fast, relevant search [OK]

Hint: Remember Elasticsearch = fast search engine [OK]

Common Mistakes:

• Confusing Elasticsearch with relational databases
• Thinking it only supports simple keyword matching
• Assuming it's mainly for visualization

2. Which Elasticsearch query syntax correctly performs a basic search for the term "apple" in the title field?

easy

A. { "query": { "find": { "title": "apple" } } }

B. { "search": { "term": { "title": "apple" } } }

C. { "query": { "match": { "title": "apple" } } }

D. { "match": { "title": "apple" } }

Solution

1. Step 1: Identify correct query structure

   Elasticsearch uses a query object with a match clause for basic text search.

2. Step 2: Check syntax correctness

   { "query": { "match": { "title": "apple" } } } correctly wraps match inside query and specifies the field and term.

3. Final Answer:

   { "query": { "match": { "title": "apple" } } } -> Option C

4. Quick Check:

   Basic search = query + match [OK]

Hint: Use {"query":{"match":{field:"term"}}} for basic search [OK]

Common Mistakes:

• Using incorrect keys like 'search' or 'find'
• Omitting the 'query' wrapper
• Placing 'match' at the root level

3. Given this Elasticsearch query, what will be the main result returned?

{ "query": { "match": { "description": "fast car" } } }

medium

A. Documents containing the exact phrase 'fast car' only

B. Documents containing either 'fast' or 'car' ranked by relevance

C. Documents containing both words 'fast' and 'car' in any order, but not ranked

D. Documents containing only the word 'fast'

Solution

1. Step 1: Understand the match query behavior

   The match query analyzes the text and searches for documents containing any of the words.

2. Step 2: Analyze how results are ranked

   Results are scored and ranked by relevance based on term frequency and other factors.

3. Final Answer:

   Documents containing either 'fast' or 'car' ranked by relevance -> Option B

4. Quick Check:

   Match query = OR search + relevance ranking [OK]

Hint: Match query finds any word and ranks results [OK]

Common Mistakes:

• Assuming match requires exact phrase
• Thinking match returns only documents with all words
• Ignoring relevance ranking

4. Identify the error in this Elasticsearch query that aims to search for "blue sky" in the title field:

{ "query": { "match": { "title": ["blue", "sky"] } } }

medium

A. The field name 'title' is invalid

B. The 'match' query cannot be used inside 'query'

C. The query is missing a 'filter' clause

D. The value for 'title' should be a string, not an array

Solution

1. Step 1: Check the value type for 'match' query

   The match query expects a string value, not an array.

2. Step 2: Confirm correct query structure

   Using an array causes a syntax error; the correct form is a single string with the phrase.

3. Final Answer:

   The value for 'title' should be a string, not an array -> Option D

4. Quick Check:

   Match value = string, not array [OK]

Hint: Match query values must be strings, not lists [OK]

Common Mistakes:

• Passing arrays instead of strings to match
• Misplacing match outside query
• Assuming filter is mandatory

5. You want to build a search feature that returns documents containing the word "coffee" but excludes those that mention "tea". Which Elasticsearch query correctly achieves this?

hard

A. { "query": { "bool": { "must": { "match": { "content": "coffee" } }, "must_not": { "match": { "content": "tea" } } } } }

B. { "query": { "match": { "content": "coffee AND NOT tea" } } }

C. { "query": { "term": { "content": "coffee" } }, "filter": { "term": { "content": "tea" } } }

D. { "query": { "bool": { "should": { "match": { "content": "coffee" } }, "filter": { "match": { "content": "tea" } } } } }

Solution

1. Step 1: Use a boolean query to combine conditions

   The bool query allows combining must and must_not clauses for inclusion and exclusion.

2. Step 2: Specify 'must' for 'coffee' and 'must_not' for 'tea'

   This ensures documents contain 'coffee' but exclude those mentioning 'tea'.

3. Final Answer:

   { "query": { "bool": { "must": { "match": { "content": "coffee" } }, "must_not": { "match": { "content": "tea" } } } } } -> Option A

4. Quick Check:

   Bool query with must and must_not = correct filter [OK]

Hint: Use bool query with must and must_not for include/exclude [OK]

Common Mistakes:

• Using AND NOT inside match query string
• Misusing filter clause for exclusion
• Using should instead of must for required terms