[[search-request-body]] === Request Body Search Specifies search criteria as request body parameters. [source,console] -------------------------------------------------- GET /twitter/_search { "query" : { "term" : { "user" : "kimchy" } } } -------------------------------------------------- // TEST[setup:twitter] [[search-request-body-api-request]] ==== {api-request-title} `GET //_search { "query": {} }` [[search-request-body-api-desc]] ==== {api-description-title} The search request can be executed with a search DSL, which includes the <>, within its body. [[search-request-body-api-path-params]] ==== {api-path-parms-title} ``:: (Optional, string) Comma-separated list of data streams, indices, and index aliases to search. Wildcard (`*`) expressions are supported. + To search all data streams and indices in a cluster, omit this parameter or use `_all` or `*`. [[search-request-body-api-request-body]] ==== {api-request-body-title} See the search API's <>. ==== Fast check for any matching docs NOTE: `terminate_after` is always applied **after** the `post_filter` and stops the query as well as the aggregation executions when enough hits have been collected on the shard. Though the doc count on aggregations may not reflect the `hits.total` in the response since aggregations are applied **before** the post filtering. In case we only want to know if there are any documents matching a specific query, we can set the `size` to `0` to indicate that we are not interested in the search results. Also we can set `terminate_after` to `1` to indicate that the query execution can be terminated whenever the first matching document was found (per shard). [source,console] -------------------------------------------------- GET /_search?q=message:number&size=0&terminate_after=1 -------------------------------------------------- // TEST[setup:twitter] The response will not contain any hits as the `size` was set to `0`. The `hits.total` will be either equal to `0`, indicating that there were no matching documents, or greater than `0` meaning that there were at least as many documents matching the query when it was early terminated. Also if the query was terminated early, the `terminated_early` flag will be set to `true` in the response. [source,console-result] -------------------------------------------------- { "took": 3, "timed_out": false, "terminated_early": true, "_shards": { "total": 1, "successful": 1, "skipped" : 0, "failed": 0 }, "hits": { "total" : { "value": 1, "relation": "eq" }, "max_score": null, "hits": [] } } -------------------------------------------------- // TESTRESPONSE[s/"took": 3/"took": $body.took/] The `took` time in the response contains the milliseconds that this request took for processing, beginning quickly after the node received the query, up until all search related work is done and before the above JSON is returned to the client. This means it includes the time spent waiting in thread pools, executing a distributed search across the whole cluster and gathering all the results. include::request/docvalue-fields.asciidoc[] include::request/collapse.asciidoc[] [[request-body-search-highlighting]] ==== Highlighting See <>. include::request/index-boost.asciidoc[] include::request/inner-hits.asciidoc[] include::request/min-score.asciidoc[] include::request/named-queries-and-filters.asciidoc[] include::request/post-filter.asciidoc[] include::request/preference.asciidoc[] include::request/rescore.asciidoc[] include::request/script-fields.asciidoc[] include::request/scroll.asciidoc[] include::request/search-after.asciidoc[] include::request/search-type.asciidoc[] include::request/sort.asciidoc[] include::request/source-filtering.asciidoc[] include::request/stored-fields.asciidoc[] include::request/track-total-hits.asciidoc[]