Elastic Certified Engineer: Search study guide

What to know

Query DSL splits into full-text queries (match, match_phrase, multi_match, query_string) and term-level queries (term, terms, range, exists, prefix, wildcard, fuzzy). bool composes them with must, filter, should and must_not; filter and must_not contribute no score and are cacheable. Relevance comes from BM25 by default and can be shaped with boost, function_score, constant_score and rescore. Dates accept math such as "gte": "now-7d/d", and the multi_match types (best_fields, most_fields, cross_fields, phrase_prefix) change how per-field scores combine.

Traps

match analyzes its input; term does not. A term query on an analyzed text field rarely matches, and a match query on a keyword field only matches the entire value.
minimum_should_match defaults to 1 only when there is no must or filter clause. Adding a must silently makes should optional (scoring only).
from + size is capped by index.max_result_window (default 10,000). Deep paging needs search_after with a unique tiebreaker sort, or a point-in-time plus search_after.
must_not never scores, and a bool query containing only must_not matches everything else.
Range queries on keyword fields compare lexicographically, not numerically or chronologically.

Rule of thumb

Put anything that only filters (status, tenant, date window) in filter, and keep must/should for clauses that should influence ranking - it improves both latency and score stability.