7

What is the difference between Only match and bool must match query in ES?

First, Only use the match query

{
   "query":{
      "match":{
         "address":"mill"
      }
   }
}

enter image description here

Second, use compound query

{
  "query": {
    "bool": {
      "must": [
        { "match": { "address": "mill" } }
      ]
     }
   }
}

enter image description here

Can you tell me everything? What is difference between them?

Amit
  • 30,756
  • 6
  • 57
  • 88
Johnson
  • 147
  • 2
  • 7

2 Answers2

10

When you use only one match inside a bool must clause then there is no difference, the bool clause is useful when you want to combine multiple(boolean) criteria, more info on official ES doc. It supports below criteria.

  1. must
  2. must_not
  3. filter
  4. should

Let me show by taking a small example from your question.

Index mapping with just address and first_name

{
    "mappings": {
        "properties": {
            "address": {
                "type": "text"
            },
            "first_name" :{
                "type" : "text"
            }
        }
    }
}

Index 3 docs, all having same address mill, but different first_name

{
   "address" : "mill",
   "first_name" : "Johnson"
}

{
   "address" : "mill",
   "first_name" : "Parker"
}

{
   "address" : "mill",
   "first_name" : "opster"
}

Search query to show all adresses of mill but must_not contain first_name as parker

{
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "address": "mill"
                    }
                },
                {
                    "must_not": {
                        "first_name": "parker"
                    }
                }
            ]
        }
    }
}

Result only 2 address

"hits": [
         {
            "_index": "so-60620921-bool",
            "_type": "_doc",
            "_id": "2",
            "_score": 0.13353139,
            "_source": {
               "address": "mill",
               "first_name": "opster"
            }
         },
         {
            "_index": "so-60620921-bool",
            "_type": "_doc",
            "_id": "3",
            "_score": 0.13353139,
            "_source": {
               "address": "mill",
               "first_name": "Johnson"
            }
         }
      ]

Based on the OP comments, providing the query and filter context, to understand the performance aspects in details.

Amit
  • 30,756
  • 6
  • 57
  • 88
  • Thanks! Can 'match' and 'must not' be written in the same depth? – Johnson Mar 12 '20 at 04:36
  • 1
    That `must_not` query is completely new to me ;-) `no [query] registered for [must_not]` it should be at the same level as `must` – Val Mar 12 '20 at 05:07
  • @Val, Sorry was on mobile and read it as `must` and `must_not` :), thanks for pointing this out :) – Amit Mar 12 '20 at 05:09
  • @Johnson, Added query and filter context link, which would help to understand, how these queries work internally and affect the performance. – Amit Mar 12 '20 at 05:12
  • @Johnson, please refer @val comment on your `Can 'match' and 'must not' be written in the same depth` query. – Amit Mar 12 '20 at 05:14
2

As written in your question, they will perform the same action.

The match query is a very straight forward full-text condition statement.

The bool query allows you to add multiple fields and multiple conditions such as exists (to validate a certain field is found in the documents), should (an OR equivalent) and must_not (a NOT equivalent).

Taking again your example, since the bool query only has a single must, match condition, it will only return all the documents with the value mill contained in the address field.

Hope this is helpful! :)

Kevin Quinzel
  • 1,430
  • 1
  • 13
  • 23
  • Thanks. I think they have difference like performance.. or anything else.. – Johnson Mar 12 '20 at 04:40
  • 3
    @Johnson, for your given case, there is no difference in performance, but id you add `filter` in your `bool` clause, then it makes a big difference in performance, as Elasticsearch first execute the filters(which makes fewer documents to search) and then excute the search on remaining documents, on top of that, filters are cached , which means next time same query will be much faster. – Amit Mar 12 '20 at 05:08
  • Yes. Filter for the win :) – Kevin Quinzel Mar 12 '20 at 05:34