Search Resource

Path : /{index name?}/{type name?}/{_search | _suggest | _agg}


Execute the provided search parameters and return a result set and any specified facets or aggregations. You can use either the GET api (specified below) or the POST request-body API. The request-body API is the same query syntax as supported by Elastic.

  • The _search URL will return both document matches and aggregations.
  • The _agg URL will return a simplified JSON map containing only the requested aggregation.
  • The _suggest URL will return a simplified JSON list containing only the matching suggestions. _agg and _suggest are both intended for ease of development, as working with the complex maps returned by _search can be very tedious in Javascript.


Name Value Description
q OR qor any The phrase or term to search for. A specific field can be named with the form “field-name:search-term”, where field-name is a specific field and search-term is a specific term. “q” logically ANDs the query. “qor” logically ORs the query.
sq any Perform a suggest query, returning only suggestion phrases and words that can be completions of the value given to the “sq” parameter.
f OR for any A filter to run against the search result set, limiting the retured documents. As with the “q” parameter, a specific field can be named. “f” logically ANDs the filter. “for” logically ORs the filter.
ff OR ffor any As per the “f” parameter, but also apply this filter to any facets or aggregations. “ff” logically ANDs the filter. “ffor” logically ORs the filter.
tf string Perform a faceting operation on the specified field. If the field is a string type, it will perform a terms facet. If the field is a timestamp, it will perform a data histogram. If the field is numeric, it will perform a stats facet.
aggs string Perform an aggregation on the specified field. You can specify a either a single field or a comma-separated list of field names. If a list of names is provided, the aggregation will perform a multi-level bucketing aggregation. If the specified fields are strings, a “term” aggregation will be performed, grouping responses into buckets based on the contained value. If the specified field is a datetime, a “histogram” aggregation will be performed, grouping responses into a date range bucket, such as a day, week, or month. If the specified field is number, statistics are performed on the values, returning max, min, average, or sum values.
size number Set the size of the results returned for this query
offset number Start returned results at the specified result (i.e., offset=10, return results starting at the 10th result).
o string Sort the results by the specified field. Naming the field starting with a minus sign, will indicate you want the results sorted in descending order.

Code Sample:

curl -X GET --user username:password
Success response code: 200

Read the Search Responses section for additional information


{ "status": 200, "_type": "test-type", "links": [ { "url": "", "rel": "self" } ], "_source": { “message”: “Helloworld” } }

Error response code:

Error Code Reason
401 You did not provide authorization credentials.
403 The credentials you provided were incorrect or not recognized.
404 The specified document does not exist.