Querying, Filtering & Aggregations

Basic Full-Text Search

POST /articles/_search
{
  "query": {
    "match": { "title": "elasticsearch" }
  }
}

bool Query — Combining Conditions

POST /articles/_search
{
  "query": {
    "bool": {
      "must":     [{ "match": { "title": "elasticsearch" } }],
      "filter":   [{ "range": { "published_at": { "gte": "2026-01-01" } } }],
      "must_not": [{ "term": { "status.keyword": "draft" } }]
    }
  }
}

must/should affect relevance score; filter is a yes/no match with no scoring — put non-ranking conditions (date ranges, exact category matches) in filter, since it's cacheable and faster. Relevance scoring itself commonly uses BM25 by default.

Aggregations

POST /articles/_search
{
  "size": 0,
  "aggs": {
    "by_month": {
      "date_histogram": { "field": "published_at", "calendar_interval": "month" },
      "aggs": { "avg_views": { "avg": { "field": "views" } } }
    }
  }
}
// like SQL GROUP BY + aggregate functions — powers Kibana dashboards

Analyzers

An analyzer pipeline (tokenizer + filters like lowercasing and stop-word removal) determines how text fields match at search time. The default "standard" analyzer covers most cases; custom analyzers add language-specific stemming or different tokenization.

The ELK Stack

Elasticsearch (storage/search/analytics) + Logstash (ingestion/transform pipeline) + Kibana (dashboards/visualization) — the common combination for centralized log aggregation and analysis.