elasticsearch-query | elasticsearch-query easily generate complex | Search Engine library

Adjacent word with any order should not be search with query_string but wildcard or match or term or span_term

There is also a mapping type wildcard optimised for this usage, depends on what type of queries you will need.

So for you first example :

You need to add the size param in the terms aggregation

The size parameter can be set to define how many term buckets should be returned out of the overall terms list.

After a lot of tries and frustration i decided to solve my problem with a painless script. It's not perfect from a performance point of view but it works.

Another guess, but perhaps...

Your question already contains the solution to your "problem".

In your must_not-clause you are using a term-query which tests for exact match, whereas in your "test"-query you use a phrase-query. If your message contains the phrase, but also some additional bytes/text, the term-query no longer matches.

Solution Simply replace term by match_phrase in your bool-query.