Dev
Elasticsearch Query Generator
Elasticsearch query DSL is deeply nested JSON, and putting a scoring condition in a filter clause or a range in a must clause produces incorrect results or slow queries. This tool generates a correctly structured DSL body for one of four common patterns so you start with the right shape. Pick the pattern — Full-text match, Bool filter + must, Range filter, or Aggregation (terms) — and name the field. The bool template puts full-text conditions in `must` (where they score) and exact-match conditions in `filter` (cached, no scoring). The range template uses Elasticsearch date math like `now-7d/d`. The aggregation template sets `"size": 0` so only bucket results are returned. Paste the body into Kibana Dev Tools, replace the example search terms and status filter with your real values, and adjust `size` and `sort` to fit.
How to use
- Choose your options above
- Click Generate
- Copy your result
Detailed instructions
- Pick the query pattern you need.
- Enter the field name to query.
- Click Generate to produce the query DSL.
- Paste it into Kibana Dev Tools and replace the placeholders.
Use Cases
- •Starting a full-text search query against an index
- •Combining scoring must clauses with cached filter clauses
- •Filtering documents by a date or numeric range
- •Building a terms aggregation for a facet or report
- •Recalling the Elasticsearch query DSL structure
Tips
- →Keep exact matches in filter context so they get cached.
- →Use date math like now-7d/d for rolling time windows.
- →Set size to 0 when you only want aggregation results.
- →Add explain to debug why a document scored the way it did.
FAQ
when should I use filter vs must
Use `filter` for exact-match and range conditions — it skips relevance scoring and its results are cached, making it faster. Use `must` for full-text conditions where the match score should influence ranking. The bool query template combines both.
why does the aggregation set size to 0
Setting `"size": 0` tells Elasticsearch not to return matching documents, only the aggregation buckets. This avoids transferring hits you do not need and makes aggregation queries much cheaper.
what does now-7d/d mean in the range filter
`now-7d` is seven days ago and `/d` rounds it to the start of that day. Elasticsearch date math lets you express rolling time windows without computing Unix timestamps, and the values update automatically on each query.
You might also like
Popular tools from other categories that share themes with this one.
Try these next
More free tools from other corners of the catalog, picked by shared themes.