What is the query then fetch process in Elasticsearch search?
Understand Elasticsearch query then fetch — the two-phase search that gathers shard IDs and scores first, then fetches full documents for only the top hits.
Expected Interview Answer
Query then fetch is the two-phase model Elasticsearch uses to run a distributed search: in the query phase each shard returns only matching document IDs and scores, and in the fetch phase the coordinating node retrieves the full documents for just the final top hits.
During the query phase the coordinating node broadcasts the search to every relevant shard, and each shard builds its own local priority queue of the top matches, returning just the document IDs, sort values, and scores — not the document bodies. The coordinator merges these into a single globally sorted list. In the fetch phase it then asks only the shards that own the final top-N hits for the actual _source and requested fields, assembling the complete response. Splitting the work this way avoids transferring full documents from every shard, which would be enormously wasteful for large result sets.
- Avoids shipping full documents from every shard
- Only the final top-N documents are ever fetched
- Keeps network transfer proportional to result size, not corpus size
- Enables consistent global ranking across shards
- Scales scatter-gather search to many shards efficiently
AI Mentor Explanation
It is like scouting players in two rounds: first every regional selector sends only a shortlist of names and scores rather than full dossiers, the chief selector merges these into one ranked shortlist, and only then are the complete profiles of the final picks requested and read in detail.
Step-by-Step Explanation
Step 1
Broadcast the query
The coordinating node sends the search to every relevant shard, primary or replica.
Step 2
Local top-N per shard
Each shard scores matches and builds a local priority queue, returning only IDs, scores, and sort values.
Step 3
Merge globally
The coordinator merges all shard results into one globally sorted list and picks the final top hits.
Step 4
Fetch documents
It requests the full _source and fields only from the shards owning those final top hits.
Step 5
Assemble response
The coordinator combines the fetched documents into the ordered result and returns it to the client.
What Interviewer Expects
- That the query phase returns IDs and scores, not full documents
- That the fetch phase retrieves _source only for the final top hits
- Why the split saves network bandwidth
- How global ranking is achieved by merging local priority queues
- Awareness of alternatives like dfs_query_then_fetch
Common Mistakes
- Thinking full documents are returned in the query phase
- Believing every shard sends complete documents to the coordinator
- Confusing scoring (query phase) with retrieval (fetch phase)
- Assuming deep pagination is cheap under this model
Best Answer (HR Friendly)
“Elasticsearch searches in two steps: first it asks every data shard for just the IDs and scores of its best matches, combines those into one ranked list, and only then goes back to get the full content for the handful of results that actually made the top. This keeps searches fast by not moving data it will never show.”
Code Example
# Default two-phase search
GET /products/_search?search_type=query_then_fetch
{
"size": 10,
"query": { "match": { "title": "wireless headphones" } }
}
# Query phase: each shard returns only doc IDs + scores.
# Fetch phase: only the top 10 docs' _source is retrieved.
# dfs_query_then_fetch first gathers global term stats
# for more accurate scoring across shards, at extra cost.Follow-up Questions
- How does dfs_query_then_fetch differ from query_then_fetch?
- Why does deep pagination become expensive under query then fetch?
- What is a shard-local priority queue and why is it used?
- How does the coordinating node achieve consistent global ranking?
- How does search_after help avoid deep pagination cost?
MCQ Practice
1. What does each shard return during the query phase?
The query phase returns lightweight IDs, scores, and sort values so the coordinator can rank globally.
2. In the fetch phase, which documents are retrieved in full?
Only the globally ranked top hits have their _source fetched, minimising data transfer.
3. Why is query then fetch efficient?
By moving only IDs and scores first, it transfers full documents only for the results it will actually return.
Flash Cards
What are the two phases? — Query phase (gather IDs and scores) then fetch phase (retrieve full documents for the top hits).
What does the query phase return? — Document IDs, scores, and sort values from each shard's local priority queue — not the document bodies.
What happens in the fetch phase? — The coordinator pulls _source and fields only from shards owning the final top-N hits.
Why split into two phases? — To rank globally while transferring full documents only for results that will actually be shown.
Continue Learning
Related Interview Questions
How do you handle pagination in Elasticsearch and why is deep pagination a problem?
medium
What is the role of the coordinating node in an Elasticsearch query?
medium
What is a bool query in Elasticsearch and how do must, should, must_not, and filter work?
medium
What is a refresh and a flush in Elasticsearch?
medium