Saved searches and filters in Elasticsearch - Step-by-Step Execution

Concept Flow - Saved searches and filters

User creates search query

↓

Apply filters to narrow results

↓

Save search + filters as named object

↓

Retrieve saved search

↓

Execute saved search with filters

↓

Display filtered results

↓

End

User builds a search with filters, saves it, then later retrieves and runs it to get filtered results.

Execution Sample

Elasticsearch

POST /my-index/_search
{
  "query": {
    "bool": {
      "filter": [{ "term": { "status": "active" }}]
    }
  }
}

This query searches 'my-index' for documents where 'status' is 'active' using a filter.

Execution Table

Step	Action	Query State	Filter Applied	Result Preview
1	Create base query	match_all	none	All documents
2	Add filter term status=active	match_all	status=active	Only active documents
3	Save search as 'ActiveStatusSearch'	match_all	status=active	Saved query object
4	Retrieve 'ActiveStatusSearch'	match_all	status=active	Ready to run
5	Execute saved search	match_all	status=active	Filtered active documents
6	Display results	match_all	status=active	Documents with status active

💡 Execution ends after displaying filtered results from saved search.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
query	match_all	match_all	match_all	match_all	match_all
filter	none	status=active	status=active	status=active	status=active
saved_search	none	none	ActiveStatusSearch object	ActiveStatusSearch object	ActiveStatusSearch object
results	none	none	none	filtered docs	filtered docs

Key Moments - 3 Insights

Why do we use filters instead of queries for conditions like status?

Filters are faster and cacheable; as shown in execution_table step 2, adding a filter narrows results efficiently without scoring.

What happens when we save a search with filters?

Saving stores the entire query and filter setup as one object (step 3), so it can be reused exactly later.

How does retrieving a saved search help?

It loads the saved query and filters ready to run (step 4), saving time and avoiding retyping.

Visual Quiz - 3 Questions

Look at the execution_table, what filter is applied at step 2?

A match_all

B status=active

C term=inactive

D no filter

💡 Hint

Check the 'Filter Applied' column at step 2 in the execution_table.

At which step is the search saved as a named object?

A Step 5

B Step 1

C Step 3

D Step 6

💡 Hint

Look for the action mentioning 'Save search' in the execution_table.

If we remove the filter, what would the results show at step 5?

A All documents

B No documents

C Only active documents

D Only inactive documents

💡 Hint

Refer to variable_tracker for 'filter' variable and its effect on 'results'.

Concept Snapshot

Saved searches combine queries and filters into reusable objects.
Filters narrow results efficiently without scoring.
Save searches to avoid rewriting queries.
Retrieve saved searches to run them anytime.
Use filters for fast, cacheable conditions.

Full Transcript

This visual execution shows how saved searches and filters work in Elasticsearch. First, a base query is created that matches all documents. Then, a filter is added to select only documents where status is active. This filtered query is saved as a named search object. Later, the saved search is retrieved and executed, returning only active documents. Variables like 'query' and 'filter' track the state of the search, and the saved search stores the combined query and filter for reuse. Filters improve performance by narrowing results without scoring. Saving searches saves time and ensures consistent queries. Retrieving saved searches loads them ready to run. The execution table and variable tracker help visualize each step clearly.