Reference · Cheat sheet
The compressed essence. Print it, pin it.
char filters → tokenizer → token filters → terms
| Stage | Count | Does | Examples |
|---|---|---|---|
| char filters | 0+ | rewrite raw characters | html_strip, mapping |
| tokenizer | exactly 1 | split into tokens | standard, whitespace, edge_ngram |
| token filters | 0+ | add / remove / change tokens | lowercase, stop, stemmer, synonym |
standard analyzer = standard tokenizer + lowercase.
"The Quick-Brown Fox" → thequickbrownfox
match) → look those terms up.search_analyzer. Different tokens on the two sides ⇒ silent miss.text vs keyword| Type | Analyzed? | Stored | Use for |
|---|---|---|---|
text | yes | many tokens | match full-text search |
keyword | no (verbatim) | one exact term | exact match, sort, aggregations |
Dynamic string mapping → both: a text field and a .keyword sub-field.
match analyzes its input · term does not (verbatim lookup).
| Symptom | Cause | Fix |
|---|---|---|
term on text → 0 hits | query not analyzed, field was (case/split differ) | use match, or term on .keyword |
match on keyword → 0 hits | field not analyzed, stores whole string | match the full value, or map as text |
POST /_analyze // what tokens does this analyzer emit?
{ "analyzer": "standard", "text": "The Quick-Brown Fox" }
POST /index/_analyze // use a specific field's mapped analyzer
{ "field": "title", "text": "Elasticsearch" }
GET /index/_mapping // is the field text or keyword?