Why compound queries combine conditions in Elasticsearch - Visual Breakdown

Concept Flow - Why compound queries combine conditions

Start: Define compound query

↓

Add multiple conditions

↓

Combine conditions using AND/OR/NOT

↓

Execute query

↓

Return documents matching combined conditions

Compound queries combine multiple conditions to filter documents by applying AND, OR, or NOT logic before returning matching results.

Execution Sample

Elasticsearch

{
  "bool": {
    "must": [
      { "match": { "title": "python" } },
      { "range": { "year": { "gte": 2020 } } }
    ]
  }
}

This query finds documents where the title contains 'python' AND the year is 2020 or later.

Execution Table

Step	Condition Evaluated	Result for Document A	Result for Document B	Combined Result
1	title contains 'python'	True	False
2	year >= 2020	True	True
3	Combine with AND			Document A: True AND True = True Document B: False AND True = False
4	Return matching documents	Document A included	Document B excluded

💡 Query returns only documents where all conditions in 'must' are true.

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
Document A title match	Unknown	True	True	True
Document A year check	Unknown	Unknown	True	True
Document B title match	Unknown	False	False	False
Document B year check	Unknown	Unknown	True	False (due to AND)

Key Moments - 2 Insights

Why does Document B get excluded even though it meets the year condition?

Because the compound query uses AND (must), all conditions must be true. Document B fails the title match (Step 1), so combined result is false (Step 3).

What happens if we use OR instead of AND to combine conditions?

Using OR (should) means documents matching any condition are included. So Document B would be included if it matches the year condition.

Visual Quiz - 3 Questions

Look at the execution table, what is the combined result for Document A at Step 3?

A Unknown

B True

C False

D Error

💡 Hint

Check Step 3 row under Combined Result column for Document A.

At which step does the query decide to exclude Document B?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Look at when combined conditions are evaluated in the execution table.

If we change 'must' to 'should' in the query, what happens to Document B?

A It causes an error

B It is excluded because it fails title match

C It is included because it matches one condition

D It is included only if both conditions match

💡 Hint

Recall key moment about OR (should) logic allowing any condition to match.

Concept Snapshot

Compound queries combine multiple conditions using AND (must), OR (should), or NOT (must_not).
All conditions in 'must' must be true for a document to match.
'Should' means any condition true includes the document.
This lets you filter documents precisely by combining criteria.
Example: title contains 'python' AND year >= 2020.

Full Transcript

Compound queries in Elasticsearch combine multiple conditions to filter documents. They use logical operators like AND (must), OR (should), and NOT (must_not). For example, a query with 'must' conditions requires all conditions to be true for a document to match. In the sample query, documents must have a title containing 'python' and a year greater or equal to 2020. The execution table shows step-by-step evaluation: first checking each condition per document, then combining results with AND. Document A matches both conditions and is included. Document B fails the title condition and is excluded. Changing 'must' to 'should' would include documents matching any condition. This approach helps build precise searches by combining multiple filters.

Practice

1. What is the main purpose of using compound queries in Elasticsearch?

easy

A. To combine multiple conditions for more precise search results

B. To speed up the indexing process

C. To delete documents from the index

D. To create new indexes automatically

Solution

1. Step 1: Understand the role of compound queries

   Compound queries allow combining several conditions to refine search results.

2. Step 2: Identify the main benefit

   Combining conditions helps find exactly what you want by mixing rules.

3. Final Answer:

   To combine multiple conditions for more precise search results -> Option A

4. Quick Check:

   Compound queries = combine conditions [OK]

Hint: Compound queries mix conditions to narrow search [OK]

Common Mistakes:

• Thinking compound queries speed up indexing
• Confusing compound queries with index creation
• Believing compound queries delete documents

2. Which of the following is the correct syntax to combine conditions using a bool query in Elasticsearch?

easy

A. {"bool": {"must": [{"match": {"field": "value"}}]}}

B. {"combine": {"and": [{"match": {"field": "value"}}]}}

C. {"query": {"combine": [{"match": {"field": "value"}}]}}

D. {"bool": {"combine": [{"match": {"field": "value"}}]}}

Solution

1. Step 1: Recall the correct bool query syntax

   The bool query uses keys like must, should, must_not, and filter inside a bool object.

2. Step 2: Match the syntax with options

   {"bool": {"must": [{"match": {"field": "value"}}]}} correctly uses "bool" with "must" and a match clause.

3. Final Answer:

   {"bool": {"must": [{"match": {"field": "value"}}]}} -> Option A

4. Quick Check:

   Bool query uses must inside bool [OK]

Hint: Bool query uses must, should, must_not, filter keys [OK]

Common Mistakes:

• Using 'combine' instead of 'bool'
• Placing conditions outside bool
• Wrong nesting of match inside combine

3. Given this Elasticsearch bool query, what documents will it match?

{"bool": {"must": [{"match": {"title": "apple"}}], "must_not": [{"match": {"status": "sold"}}]}}

medium

A. Documents with title 'apple' and status 'sold'

B. Documents with title containing 'apple' and status not 'sold'

C. Documents with title 'apple' or status 'sold'

D. Documents with status 'sold' only

Solution

1. Step 1: Analyze the must clause

   The must clause requires the title field to match 'apple'.

2. Step 2: Analyze the must_not clause

   The must_not clause excludes documents where status matches 'sold'.

3. Final Answer:

   Documents with title containing 'apple' and status not 'sold' -> Option B

4. Quick Check:

   Must + must_not = include and exclude [OK]

Hint: Must means include; must_not means exclude [OK]

Common Mistakes:

• Confusing must_not as must
• Thinking must_not includes documents
• Mixing OR logic instead of AND

4. Identify the error in this Elasticsearch bool query:

{"bool": {"must": {"match": {"name": "john"}}, "should": [{"term": {"age": 30}}]}}

medium

A. "match" is not valid inside "must"

B. "should" cannot be used with "must"

C. "must" should be an array, not a single object

D. The query is correct as is

Solution

1. Step 1: Check the structure of must clause

   The must clause expects an array of conditions, but here it is a single object.

2. Step 2: Verify should clause usage

   The should clause is correctly an array, so no error there.

3. Final Answer:

   "must" should be an array, not a single object -> Option C

4. Quick Check:

   Must requires array of conditions [OK]

Hint: Must and should clauses expect arrays [OK]

Common Mistakes:

• Using object instead of array for must
• Thinking should can't be with must
• Misplacing match inside must

5. You want to find documents where the field "category" is "books" and either "author" is "Alice" or "year" is 2020, but exclude those with "status" as "archived". Which bool query correctly combines these conditions?

hard

A. {"bool": {"should": [{"term": {"category": "books"}}, {"term": {"author": "Alice"}}, {"term": {"year": 2020}}], "must_not": [{"term": {"status": "archived"}}]}}

B. {"bool": {"must": [{"term": {"category": "books"}}, {"term": {"author": "Alice"}}], "must_not": [{"term": {"status": "archived"}}]}}

C. {"bool": {"filter": [{"term": {"category": "books"}}], "must": [{"term": {"author": "Alice"}}, {"term": {"year": 2020}}], "must_not": [{"term": {"status": "archived"}}]}}

D. {"bool": {"must": [{"term": {"category": "books"}}], "should": [{"term": {"author": "Alice"}}, {"term": {"year": 2020}}], "must_not": [{"term": {"status": "archived"}}]}}

Solution

1. Step 1: Identify the required conditions

   Must have category = books, should have author = Alice or year = 2020, and must_not have status = archived.

2. Step 2: Match conditions to bool clauses

   Category is mandatory (must), author or year is optional but at least one (should), and status excluded (must_not).

3. Final Answer:

   {"bool": {"must": [{"term": {"category": "books"}}], "should": [{"term": {"author": "Alice"}}, {"term": {"year": 2020}}], "must_not": [{"term": {"status": "archived"}}]}} -> Option D

4. Quick Check:

   Must + should + must_not combined correctly [OK]

Hint: Must = required, should = optional OR, must_not = exclude [OK]

Common Mistakes:

• Putting author in must instead of should
• Using filter instead of must for category
• Putting all conditions in should