What is the difference between keyword and text field types in Elasticsearch?
Learn the difference between keyword and text fields in Elasticsearch: analysis, exact match, sorting, aggregations, multi-fields, and when to use each.
Expected Interview Answer
A text field is analyzed — broken into lowercase tokens for full-text search — while a keyword field is stored as a single, exact, unanalyzed string used for filtering, sorting, and aggregations.
When you index a text field, Elasticsearch runs it through an analyzer that tokenizes and normalizes the value, so 'Senior Data Engineer' becomes searchable terms like 'senior', 'data', 'engineer'. A keyword field skips analysis entirely and keeps the exact bytes, which makes it perfect for exact-match term queries, terms aggregations, and sorting but useless for partial word matching. Because each type serves a different need, strings are often indexed as both using a multi-field mapping: 'title' as text and 'title.keyword' as keyword.
- text enables relevance-ranked full-text search
- keyword enables exact filtering, sorting, and aggregations
- Multi-fields let one string be both searchable and aggregatable
- keyword avoids the cost of analysis at index time
- Choosing correctly prevents wasted memory and wrong query results
AI Mentor Explanation
Think of a text field like the running commentary of an innings: the sentences are split into individual words so you can search for any phrase a commentator said. A keyword field is like the fixed player ID on the team sheet — you never chop it up, you match it exactly to pull that one player's record, sort the batting order, or count how many times each ID appears in the scorecard.
Step-by-Step Explanation
Step 1
Decide the query need
Ask whether the field needs full-text search or exact match, sorting, and aggregation.
Step 2
Pick the base type
Use text for prose you search into; use keyword for IDs, tags, statuses, and enums.
Step 3
Add a multi-field when both apply
Map the field as text with a nested 'keyword' sub-field so one value serves both purposes.
Step 4
Set ignore_above for keyword
Cap keyword length (default 256) so very long strings are not indexed and bloat memory.
Step 5
Query the right sub-field
Use match on the text field and term/aggregation on the .keyword sub-field.
What Interviewer Expects
- Clear understanding that text is analyzed and keyword is not
- Knowing keyword is used for sorting, filtering, and aggregations
- Awareness of multi-field mappings
- Understanding why term queries fail on analyzed text
- Mention of ignore_above and memory implications
Common Mistakes
- Using a term query on a text field and getting no results
- Trying to sort or aggregate on an analyzed text field
- Forgetting the .keyword sub-field exists on dynamic string mappings
- Indexing large blobs as keyword without ignore_above
- Assuming keyword fields are case-insensitive by default
Best Answer (HR Friendly)
“In Elasticsearch, a text field is meant for searching through sentences and gets broken into words, while a keyword field keeps a value exactly as-is for precise matching, sorting, and grouping. Many string fields are set up as both so you can search them and also count or filter them cleanly.”
Code Example
PUT /jobs
{
"mappings": {
"properties": {
"title": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}GET /jobs/_search
{
"query": { "match": { "title": "data engineer" } },
"aggs": {
"by_title": {
"terms": { "field": "title.keyword" }
}
}
}Follow-up Questions
- Why does a term query on a text field often return no results?
- What does ignore_above do on a keyword field?
- How do you make a keyword field case-insensitive?
- When would you disable indexing on a keyword field but keep doc_values?
- What is the difference between match and term queries?
MCQ Practice
1. Which field type should you use to run a terms aggregation on exact category values?
keyword fields keep exact values and support aggregations and sorting; analyzed text fields do not by default.
2. What happens when you index 'Data Engineer' into a standard text field?
text fields are analyzed, so the value is tokenized and lowercased into individual searchable terms.
3. What does ignore_above: 256 do on a keyword field?
Strings longer than ignore_above are stored but not indexed, so they cannot be searched or aggregated on that field.
Flash Cards
Is a text field analyzed? — Yes — it is tokenized and normalized by an analyzer for full-text search.
Is a keyword field analyzed? — No — it is stored as a single exact term for filtering, sorting, and aggregations.
What is a multi-field? — One field mapped as multiple types, e.g. text with a nested keyword sub-field.
Why does term fail on text? — term matches the exact indexed token, but text is broken into lowercased tokens, so the original phrase rarely matches.
Continue Learning
Related Interview Questions
How does Elasticsearch handle full-text search vs exact matching?
medium
What is the difference between a term query and a match query in Elasticsearch?
medium
What is mapping in Elasticsearch and why does it matter?
medium
What is a bool query in Elasticsearch and how do must, should, must_not, and filter work?
medium