What is difference between match and bool must match query in Elasticsearch
Asked Answered
G

2

7

What is the difference between Only match and bool must match query in ES?

First, Only use the match query

{
   "query":{
      "match":{
         "address":"mill"
      }
   }
}

enter image description here

Second, use compound query

{
  "query": {
    "bool": {
      "must": [
        { "match": { "address": "mill" } }
      ]
     }
   }
}

enter image description here

Can you tell me everything? What is difference between them?

Grantee answered 12/3, 2020 at 0:24 Comment(0)
R
12

When you use only one match inside a bool must clause then there is no difference, the bool clause is useful when you want to combine multiple(boolean) criteria, more info on official ES doc. It supports below criteria.

  1. must
  2. must_not
  3. filter
  4. should

Let me show by taking a small example from your question.

Index mapping with just address and first_name

{
    "mappings": {
        "properties": {
            "address": {
                "type": "text"
            },
            "first_name" :{
                "type" : "text"
            }
        }
    }
}

Index 3 docs, all having same address mill, but different first_name

{
   "address" : "mill",
   "first_name" : "Johnson"
}

{
   "address" : "mill",
   "first_name" : "Parker"
}

{
   "address" : "mill",
   "first_name" : "opster"
}

Search query to show all adresses of mill but must_not contain first_name as parker

{
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "address": "mill"
                    }
                },
                {
                    "must_not": {
                        "first_name": "parker"
                    }
                }
            ]
        }
    }
}

Result only 2 address

"hits": [
         {
            "_index": "so-60620921-bool",
            "_type": "_doc",
            "_id": "2",
            "_score": 0.13353139,
            "_source": {
               "address": "mill",
               "first_name": "opster"
            }
         },
         {
            "_index": "so-60620921-bool",
            "_type": "_doc",
            "_id": "3",
            "_score": 0.13353139,
            "_source": {
               "address": "mill",
               "first_name": "Johnson"
            }
         }
      ]

Based on the OP comments, providing the query and filter context, to understand the performance aspects in details.

Ruction answered 12/3, 2020 at 2:49 Comment(5)
Thanks! Can 'match' and 'must not' be written in the same depth?Grantee
That must_not query is completely new to me ;-) no [query] registered for [must_not] it should be at the same level as mustChlorine
@Val, Sorry was on mobile and read it as must and must_not :), thanks for pointing this out :)Ruction
@Johnson, Added query and filter context link, which would help to understand, how these queries work internally and affect the performance.Ruction
@Johnson, please refer @val comment on your Can 'match' and 'must not' be written in the same depth query.Ruction
U
2

As written in your question, they will perform the same action.

The match query is a very straight forward full-text condition statement.

The bool query allows you to add multiple fields and multiple conditions such as exists (to validate a certain field is found in the documents), should (an OR equivalent) and must_not (a NOT equivalent).

Taking again your example, since the bool query only has a single must, match condition, it will only return all the documents with the value mill contained in the address field.

Hope this is helpful! :)

Underbrush answered 12/3, 2020 at 2:38 Comment(3)
Thanks. I think they have difference like performance.. or anything else..Grantee
@Johnson, for your given case, there is no difference in performance, but id you add filter in your bool clause, then it makes a big difference in performance, as Elasticsearch first execute the filters(which makes fewer documents to search) and then excute the search on remaining documents, on top of that, filters are cached , which means next time same query will be much faster.Ruction
Yes. Filter for the win :)Underbrush

© 2022 - 2024 — McMap. All rights reserved.