Elasticsearch Query Types: match vs term vs bool

Elasticsearch query types split into two families based on whether they analyze their input before searching. Understanding which family a query belongs to prevents a common class of "why does my query return no results?" bugs.

Full-text queries — analyzed input

• match analyzes the query string through the same analyzer used to index the field — match: { body: "Spring Boot" } tokenizes to ["spring", "boot"] and finds documents containing either or both terms
• match_phrase requires terms to appear adjacent and in order — match_phrase: { body: "spring boot" } only matches documents where "spring" is immediately followed by "boot"
• Use match on text fields; the analyzer handles stemming and lowercasing automatically

Term-level queries — exact match, no analysis

• term finds documents where a field contains the exact specified value — term: { status: "active" } searches for the literal string "active" with no analysis
• Use term on keyword fields; using term on a text field often returns nothing because the indexed tokens are lowercase stemmed versions, not the original text
• terms allows multiple exact values: terms: { status: ["active", "pending"] } — equivalent to SQL's IN clause

bool query — combining conditions

• bool is the query used to combine multiple conditions: must (equivalent to AND, contributes to relevance score), should (equivalent to OR, boosts relevance), filter (equivalent to AND, does not affect score, cacheable), and must_not
• Always put filtering conditions (status, date range, user_id) in filter instead of must — filter clauses are cached by Elasticsearch and don't affect the relevance score, which means subsequent identical filter conditions are resolved from cache

Run queries in Kibana's Dev Tools with "explain": true to see exactly how terms are analyzed and why a document does or does not match.