ES|QL Search functions

Use these functions for full-text search and semantic search.

Get started with ES|QL for search use cases with our hands-on tutorial.

Full text functions can be used to match multivalued fields. A multivalued field that contains a value that matches a full text query is considered to match the query.

Full text functions are significantly more performant for text search use cases on large data sets than using pattern matching or regular expressions with LIKE or RLIKE

See full text search limitations for information on the limitations of full text search.

ES|QL supports these full-text search functions:

• [preview] KQL
• [preview] MATCH
• [preview] QSTR

Syntax

×

Parameters

query

Query string in KQL query string format.

Description

Performs a KQL query. Returns true if the provided KQL query string matches the row.

Supported types

Example

FROM books
| WHERE KQL("author: Faulkner")

Syntax

×

Parameters

field

Field that the query will target.

query

Value to find in the provided field.

options

(Optional) Match additional options as function named parameters. See match query for more information.

Description

Use MATCH to perform a match query on the specified field. Using MATCH is equivalent to using the match query in the Elasticsearch Query DSL. Match can be used on fields from the text family like text and semantic_text, as well as other field types like keyword, boolean, dates, and numeric types. Match can use function named parameters to specify additional options for the match query. All match query parameters are supported. For a simplified syntax, you can use the match operator : operator instead of MATCH. MATCH returns true if the provided query matches the row.

Supported types

Supported function named parameters

fuzziness

(keyword) Maximum edit distance allowed for matching.

auto_generate_synonyms_phrase_query

(boolean) If true, match phrase queries are automatically created for multi-term synonyms. Defaults to true.

analyzer

(keyword) Analyzer used to convert the text in the query value into token. Defaults to the index-time analyzer mapped for the field. If no analyzer is mapped, the index’s default analyzer is used.

minimum_should_match

(integer) Minimum number of clauses that must match for a document to be returned.

zero_terms_query

(keyword) Indicates whether all documents or none are returned if the analyzer removes all tokens, such as when using a stop filter. Defaults to none.

boost

(float) Floating point number used to decrease or increase the relevance scores of the query. Defaults to 1.0.

fuzzy_transpositions

(boolean) If true, edits for fuzzy matching include transpositions of two adjacent characters (ab → ba). Defaults to true.

fuzzy_rewrite

(keyword) Method used to rewrite the query. See the rewrite parameter for valid values and more information. If the fuzziness parameter is not 0, the match query uses a fuzzy_rewrite method of top_terms_blended_freqs_${max_expansions} by default.

prefix_length

(integer) Number of beginning characters left unchanged for fuzzy matching. Defaults to 0.

lenient

(boolean) If false, format-based errors, such as providing a text query value for a numeric field, are returned. Defaults to false.

operator

(keyword) Boolean logic used to interpret text in the query value. Defaults to OR.

max_expansions

(integer) Maximum number of terms to which the query will expand. Defaults to 50.

Examples

FROM books
| WHERE MATCH(author, "Faulkner")

FROM books
| WHERE MATCH(title, "Hobbit Back Again", {"operator": "AND"})
| KEEP title;

Syntax

×

Parameters

query

Query string in Lucene query string format.

options

(Optional) Additional options for Query String as function named parameters. See query string query for more information.

Description

Performs a query string query. Returns true if the provided query string matches the row.

Supported types

Supported function named parameters

max_determinized_states

(integer) Maximum number of automaton states required for the query. Default is 10000.

fuzziness

(keyword) Maximum edit distance allowed for matching.

auto_generate_synonyms_phrase_query

(boolean) If true, match phrase queries are automatically created for multi-term synonyms. Defaults to true.

phrase_slop

(integer) Maximum number of positions allowed between matching tokens for phrases. Defaults to 0 (which means exact matches are required).

default_field

(keyword) Default field to search if no field is provided in the query string. Supports wildcards (*).

allow_leading_wildcard

(boolean) If true, the wildcard characters * and ? are allowed as the first character of the query string. Defaults to true.

minimum_should_match

(string) Minimum number of clauses that must match for a document to be returned.

fuzzy_transpositions

(boolean) If true, edits for fuzzy matching include transpositions of two adjacent characters (ab → ba). Defaults to true.

fuzzy_prefix_length

(integer) Number of beginning characters left unchanged for fuzzy matching. Defaults to 0.

time_zone

(keyword) Coordinated Universal Time (UTC) offset or IANA time zone used to convert date values in the query string to UTC.

lenient

(boolean) If false, format-based errors, such as providing a text query value for a numeric field, are returned. Defaults to false.

rewrite

(keyword) Method used to rewrite the query.

default_operator

(keyword) Default boolean logic used to interpret text in the query string if no operators are specified.

analyzer

(keyword) Analyzer used to convert the text in the query value into token. Defaults to the index-time analyzer mapped for the default_field.

fuzzy_max_expansions

(integer) Maximum number of terms to which the query expands for fuzzy matching. Defaults to 50.

quote_analyzer

(keyword) Analyzer used to convert quoted text in the query string into tokens. Defaults to the search_quote_analyzer mapped for the default_field.

allow_wildcard

(boolean) If true, the query attempts to analyze wildcard terms in the query string. Defaults to false.

boost

(float) Floating point number used to decrease or increase the relevance scores of the query.

quote_field_suffix

(keyword) Suffix appended to quoted text in the query string.

enable_position_increments

(boolean) If true, enable position increments in queries constructed from a query_string search. Defaults to true.

fields

(keyword) Array of fields to search. Supports wildcards (*).

Examples

FROM books
| WHERE QSTR("author: Faulkner")

FROM books
| WHERE QSTR("title: Hobbjt~", {"fuzziness": 2})