Bool query in depth in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a basic bool query with a must clause.

Elasticsearch

{
  "query": {
    "bool": {
      "must": [
        { "match": { "title": "[1]" } }
      ]
    }
  }
}

Drag options to blanks, or click blank then click option'

Aindex

Bdatabase

Cquery

DElasticsearch

Attempts:

3 left

💡 Hint

Common Mistakes

Using a word not related to the field.

Confusing must with should.

The must clause requires the title field to match the word "Elasticsearch".

2fill in blank

medium

Complete the code to add a filter clause that matches documents with status 'active'.

Elasticsearch

{
  "query": {
    "bool": {
      "filter": [
        { "term": { "status": "[1]" } }
      ]
    }
  }
}

Drag options to blanks, or click blank then click option'

Aactive

Bpending

Cclosed

Ddeleted

Attempts:

3 left

💡 Hint

Common Mistakes

Using a status that does not exist in the data.

Confusing term with match.

The filter clause filters documents where the status field exactly matches "active".

3fill in blank

hard

Fix the error in the bool query by completing the missing clause to exclude documents with tag 'deprecated'.

Elasticsearch

{
  "query": {
    "bool": {
      "must": [
        { "match": { "content": "search" } }
      ],
      "[1]": [
        { "term": { "tag": "deprecated" } }
      ]
    }
  }
}

Drag options to blanks, or click blank then click option'

Amust_not

Bmust

Cshould

Dfilter

Attempts:

3 left

💡 Hint

Common Mistakes

Using filter instead of must_not to exclude documents.

Adding the clause under should which changes scoring.

The must_not clause excludes documents matching the condition, here those tagged as "deprecated".

4fill in blank

hard

Fill both blanks to create a bool query that must match 'python' in title and should match 'tutorial' in tags.

Elasticsearch

{
  "query": {
    "bool": {
      "[1]": [
        { "match": { "title": "python" } }
      ],
      "[2]": [
        { "match": { "tags": "tutorial" } }
      ]
    }
  }
}

Drag options to blanks, or click blank then click option'

Amust

Bfilter

Cshould

Dmust_not

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping must and should clauses.

Using filter instead of should for optional matches.

The must clause requires matching 'python' in the title, and the should clause boosts documents matching 'tutorial' in tags.

5fill in blank

hard

Fill all three blanks to create a bool query that must match 'data' in content, filters for status 'published', and excludes tag 'draft'.

Elasticsearch

{
  "query": {
    "bool": {
      "[1]": [
        { "match": { "content": "data" } }
      ],
      "[2]": [
        { "term": { "status": "published" } }
      ],
      "[3]": [
        { "term": { "tag": "draft" } }
      ]
    }
  }
}

Drag options to blanks, or click blank then click option'

Amust

Bfilter

Cmust_not

Dshould

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up filter and must_not clauses.

Using should instead of filter for filtering.

The must clause requires matching 'data' in content, filter restricts to status 'published', and must_not excludes documents tagged 'draft'.

Practice

1. Which clause in an Elasticsearch bool query is used to exclude documents from the search results?

easy

A. must

B. should

C. must_not

D. filter

Solution

1. Step 1: Understand bool query clauses

   The bool query has four main clauses: must (required matches), filter (fast filtering), should (optional matches), and must_not (exclusions).

2. Step 2: Identify exclusion clause

   The must_not clause excludes documents that match its conditions from the results.

3. Final Answer:

   must_not -> Option C

4. Quick Check:

   Exclusion = must_not [OK]

Hint: Exclude with must_not clause in bool query [OK]

Common Mistakes:

• Confusing must_not with should
• Using filter to exclude documents
• Thinking must excludes documents

2. Which of the following is the correct syntax to add a filter clause inside a bool query in Elasticsearch?

easy

A. "bool": { "must": [ { "term": { "status": "active" } } ] }

B. "bool": { "must_not": { "term": { "status": "active" } } }

C. "bool": { "should": { "term": { "status": "active" } } }

D. "bool": { "filter": [ { "term": { "status": "active" } } ] }

Solution

1. Step 1: Recall bool query syntax for filter

   The filter clause expects an array of queries inside the bool query, e.g., "filter": [ { ... } ].

2. Step 2: Match correct syntax

   "bool": { "filter": [ { "term": { "status": "active" } } ] } correctly uses "filter": [ { "term": { "status": "active" } } ] which is valid syntax.

3. Final Answer:

   "bool": { "filter": [ { "term": { "status": "active" } } ] } -> Option D

4. Quick Check:

   Filter clause uses array syntax [OK]

Hint: Filter clause always uses an array of queries [OK]

Common Mistakes:

• Using object instead of array for filter
• Confusing must_not or should syntax
• Missing brackets around filter queries

3. Given this bool query snippet, what documents will it match?

{ "bool": { "must": [ { "match": { "title": "python" } } ], "should": [ { "term": { "tags": "programming" } } ], "must_not": [ { "term": { "status": "draft" } } ] } }

medium

A. Documents with title containing 'python', optionally tagged 'programming', excluding drafts

B. Documents tagged 'programming' only, ignoring title and status

C. Documents with status 'draft' and title 'python'

D. Documents with title 'python' or status 'draft'

Solution

1. Step 1: Analyze must clause

   The must clause requires documents to have 'python' in the title.

2. Step 2: Analyze should and must_not clauses

   The should clause boosts documents tagged 'programming' but is optional. The must_not clause excludes documents with status 'draft'.

3. Final Answer:

   Documents with title containing 'python', optionally tagged 'programming', excluding drafts -> Option A

4. Quick Check:

   Must + should + must_not = Documents with title containing 'python', optionally tagged 'programming', excluding drafts [OK]

Hint: Must is required, should is optional, must_not excludes [OK]

Common Mistakes:

• Thinking should is required
• Including documents with status 'draft'
• Ignoring must clause

4. Identify the error in this bool query snippet:

{ "bool": { "must": { "term": { "user": "kimchy" } }, "filter": { "term": { "status": "active" } } } }

medium

A. Missing "should" clause

B. "must" and "filter" should be arrays, not single objects

C. Using "term" inside bool is invalid

D. The query is correct as is

Solution

1. Step 1: Check bool clause types

   In bool queries, must and filter expect arrays of queries, not single objects.

2. Step 2: Identify syntax error

   Here, both must and filter are single objects, which is invalid syntax.

3. Final Answer:

   "must" and "filter" should be arrays, not single objects -> Option B

4. Quick Check:

   Bool clauses require arrays [OK]

Hint: Bool clauses must and filter need arrays [OK]

Common Mistakes:

• Using single object instead of array
• Forgetting to wrap queries in []
• Assuming should is mandatory

5. You want to find documents where the category is 'books' and either the author is 'Alice' or the year is after 2015, but exclude any documents marked as archived. Which bool query structure correctly implements this?

hard

A. { "bool": { "must": [ { "term": { "category": "books" } } ], "should": [ { "term": { "author": "Alice" } }, { "range": { "year": { "gt": 2015 } } } ], "must_not": [ { "term": { "status": "archived" } } ] } }

B. { "bool": { "filter": [ { "term": { "category": "books" } }, { "term": { "author": "Alice" } } ], "must_not": [ { "term": { "status": "archived" } } ], "should": [ { "range": { "year": { "gt": 2015 } } } ] } }

C. { "bool": { "must": [ { "term": { "category": "books" } }, { "term": { "author": "Alice" } } ], "must_not": [ { "term": { "status": "archived" } } ], "should": [ { "range": { "year": { "gt": 2015 } } } ] } }

D. { "bool": { "must": [ { "term": { "category": "books" } } ], "filter": [ { "term": { "author": "Alice" } }, { "range": { "year": { "gt": 2015 } } } ], "must_not": [ { "term": { "status": "archived" } } ] } }

Solution

1. Step 1: Identify required and optional conditions

   The category must be 'books' (required), and either author is 'Alice' or year > 2015 (optional, so use should).

2. Step 2: Exclude archived documents

   Use must_not to exclude documents with status 'archived'.

3. Step 3: Match query structure

   { "bool": { "must": [ { "term": { "category": "books" } } ], "should": [ { "term": { "author": "Alice" } }, { "range": { "year": { "gt": 2015 } } } ], "must_not": [ { "term": { "status": "archived" } } ] } } correctly uses must for category, should for author or year, and must_not for exclusion.

4. Final Answer:

   Option A's bool query structure -> Option A

5. Quick Check:

   Must + should + must_not for conditions [OK]

Hint: Use must for required, should for alternatives, must_not to exclude [OK]

Common Mistakes:

• Putting author and year in must (both required)
• Using filter instead of should for alternatives
• Missing must_not for exclusion