Search code examples
elasticsearchfull-text-searchmatchfield

Body for searching anywhere

In Elasticsearch, it is easy to perform the following search request, for example via the browser:

<protocol>://<address>:<port>/<index>/_search?q="search term"

This must use some kind of default combination of matching over various index fields.

The usual examples one can find for searching by search body address search in specific fields.

What is the correct search body for the above type of URL query?

Solution

  • The q=... is actually equivalent to a query_string search.

    So .../index/_search?q="search term" would be equivalent to

    GET index/_search
{
  "query": {
    "query_string": {
      "query": "search term"
    }
  }
}

    One of the parameter of the query_string query is default_field, which if not specified is equal to the value of the index setting called index.query.default_field, which has a default value of * (i.e. all fields)

    If you want to restrict the search to a specific field, then you can do so:

    GET index/_search
{
  "query": {
    "query_string": {
      "query": "search term",
      "default_field": "content"
    }
  }
}

    And this would be equivalent to .../index/_search?q=content:"search term"