1、query string 语法
GET /test_index/_search?q=test_field1:updateGET /test_index/_search?q=+test_field1:update{ "took" : 7, "timed_out" : false, "_shards" : { "total" : 5, "successful" : 5, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 1, "relation" : "eq" }, "max_score" : 0.2876821, "hits" : [ { "_index" : "test_index", "_type" : "_doc", "_id" : "3", "_score" : 0.2876821, "_source" : { "test_field1" : "update test1", "test_field2" : "update test2" } } ] }}GET /test_index/_search?q=-test_field1:update{ "took" : 12, "timed_out" : false, "_shards" : { "total" : 5, "successful" : 5, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 7, "relation" : "eq" }, "max_score" : 0.0, "hits" : [ { "_index" : "test_index", "_type" : "_doc", "_id" : "10", "_score" : 0.0, "_source" : { "test_field" : "test10 routing _id" } }, { "_index" : "test_index", "_type" : "_doc", "_id" : "7", "_score" : 0.0, "_routing" : "2", "_source" : { "test_field1" : "test1" } }, { "_index" : "test_index", "_type" : "_doc", "_id" : "2", "_score" : 0.0, "_source" : { "test_field" : "test client 1", "name" : "test1" } }, { "_index" : "test_index", "_type" : "_doc", "_id" : "1", "_score" : 0.0, "_source" : { "test_field" : "test test", "name" : "test1" } }, { "_index" : "test_index", "_type" : "_doc", "_id" : "7", "_score" : 0.0, "_routing" : "1", "_source" : { "test_field1" : "test1" } }, { "_index" : "test_index", "_type" : "_doc", "_id" : "11", "_score" : 0.0, "_routing" : "12", "_source" : { "test_field" : "test routing not _id" }—— }, { "_index" : "test_index", "_type" : "_doc", "_id" : "20", "_score" : 0.0, "_source" : { "test_field" : "test consistency" } } ] }}对于query string只要掌握q=field:search content的语法，以及+和-的含义
+：代表包含这个筛选条件结果
-：代表不包含这个筛选条件的结果
2、_all metadata
也就是在使用query string的时候，如果不指定field，那么默认就是_all。_all元数据是在建立索引的时候产生的，我们插入一条document，它里面包含了多个field,此时ES会自动将多个field的值全部用字符串的方式串联起来，变成一个长的字符串。这个长的字符串就是_all field的值。同时建立索引。
举个例子：
对于一个document：
{ "name": "jack", "age": 26, "email": "jack@sina.com", "address": "guamazhou"}那么"jack 26 jack@sina.com guamazhou",就会作为这个document的_all fieldd的值，同时进行分词后建立对应的倒排索引。
注意在生产环境中一般不会使用query string这种查询方式。