Full-text Search
Description
Performs text phrase search across all source fields. It operates in two modes: exact phrase match and partial match. It also supports wildcard syntax with the *
and ?
characters.
Full-text search operates on the first 1,000 fields in a mapping. To configure the list of fields to search, go to the full-text search settings.
Full-text search is only available when querying in OpenSearch.
Syntax
search [~]"<string>"
Required Arguments
Parameter | Syntax | Description |
---|---|---|
<string> | <string> | The search phrase. Supports wildcard syntax. |
Optional Arguments
Parameter | Syntax | Description |
---|---|---|
~ | ~ | Operator for partial phrase match, allowing separate words within the phrase to be found. |
Query Examples
Example 1:
Search for all documents containing the phrase "Deactivated successfully" in any of the document's text fields.
...
| search "Deactivated successfully"
Example 2:
Search for all documents containing the words "Deactivated" and/or "successfully" in any of the document's text fields.
...
| search ~"Deactivated successfully"
Example 3:
Full-text search can be used within a boolean expression alongside other conditions.
Search for all documents that meet the following condition: the text fields contain the phrase "google.com" and the status
field has a value of 200, or the text fields contain the phrase "facebook.com" and the status
field has a value of 500.
...
| search "google.com" AND status="200" OR "facebook.com" AND status="500"