How Full Text Search Works in Elasticsearch Explained

Full text search in Elasticsearch works by breaking text into terms using analyzers and storing them in an inverted index. When you search, Elasticsearch matches query terms against this index to quickly find relevant documents.

Syntax

The basic syntax for a full text search in Elasticsearch uses the match query inside a search request. It looks like this:

• index: The name of the index to search.
• query: The search query object.
• match: The type of full text query that analyzes the input text.
• field: The document field to search in.
• query: The text string to search for.

json

{
  "query": {
    "match": {
      "field_name": "search text"
    }
  }
}

Example

This example shows a full text search on the content field for the phrase "quick brown fox". Elasticsearch analyzes the phrase, breaks it into terms, and finds documents containing those terms.

json

POST /my_index/_search
{
  "query": {
    "match": {
      "content": "quick brown fox"
    }
  }
}

Output

{
  "hits": {
    "total": {"value": 2, "relation": "eq"},
    "hits": [
      {
        "_index": "my_index",
        "_id": "1",
        "_score": 1.5,
        "_source": {"content": "The quick brown fox jumps over the lazy dog."}
      },
      {
        "_index": "my_index",
        "_id": "2",
        "_score": 1.2,
        "_source": {"content": "A quick brown fox is fast and clever."}
      }
    ]
  }
}

Common Pitfalls

Common mistakes include:

• Not using the right analyzer which can cause unexpected tokenization.
• Searching on keyword fields instead of text fields, which disables full text search.
• Expecting exact phrase matches without using match_phrase query.

Always check your field mappings and analyzers to ensure proper full text search behavior.

json

POST /my_index/_search
{
  "query": {
    "match": {
      "keyword_field": "quick brown fox"
    }
  }
}

# wrong: keyword fields do not analyze text

POST /my_index/_search
{
  "query": {
    "match": {
      "text_field": "quick brown fox"
    }
  }
}

# right: text fields are analyzed for full text search

Quick Reference

• match: Analyzes input text and finds documents with matching terms.
• match_phrase: Finds documents with exact phrase matches.
• analyzer: Breaks text into searchable terms (tokens).
• inverted index: Data structure mapping terms to documents for fast search.

Key Takeaways

Elasticsearch uses analyzers to break text into terms stored in an inverted index for fast full text search.

The match query analyzes the search text and finds documents containing those terms.

Use text fields (not keyword) for full text search to enable proper analysis.

For exact phrase matching, use the match_phrase query instead of match.

Check your field mappings and analyzers to avoid common search mistakes.