Search_Mode_And_Query_Guide

Overview

• Keep mode and query style aligned:

  • keyword: exact tokens, identifiers, and literal overlap.

  • semantic: plain-language intent and conceptual similarity.

Keyword — “fuzzy keyword search with optional exact matching”

What it does

• Runs an Elasticsearch simple_query_string-style search with:

  • Default operator: AND across all tokens.

  • Fuzzy matching enabled (e.g., fuzziness, fuzzy_max_expansions).

  • Prioritizes direct term/phrase overlap. Good recall on misspellings and near-matches; precision improves when you add quotes around phrases.

What the AI may do to the user’s query

• Keep the query verbatim, or:

  • Fix obvious spelling errors.

  • Add double quotes around words/phrases the user clearly intends as exact strings (names, IDs, titles, multi-word entities).

  • Build grouped boolean logic using +, |, -, quotes, and parentheses.

  • Build OR lists using the | operator. Example: "enterprise cyber range" | "enterprise cyber training".

  • Exclude terms using -term or -"exact phrase".

  • Use - only with at least one positive term or phrase. Do not send a query that is only exclusions.

  • Do NOT use field scoping or more advanced SQS operators (~, *, ^, field: etc.).

  • Do NOT use Lucene boolean operators (OR, AND).

Supported advanced syntax

Operator	Function
+	Explicit AND between terms or groups.
|	OR between terms or groups.
-	Exclude the immediately following term or quoted phrase.
"..."	Exact phrase match.
(...)	Group terms and control precedence.

Semantic — “Dense vector semantic search (meaning over words)”

What it does

• Embeds the user query into a dense vector and retrieves semantically similar content, independent of exact lexical overlap.

What the AI may do to the user’s query

• Send verbatim, or apply light reformulation:

  1. Synonym/paraphrase expansion

  2. Query relaxation: drop/soften narrow constraints

• Keep reformulation in plain natural language.

Examples

• If the chosen tool does not support semantic search, keep the same keyword-style query construction and omit search_mode.

Direct lookup or exact phrase: Tool: Search_<Entity>

{
  "search_mode": "keyword",
  "query": "\"<IDENTIFIER_OR_EXACT_PHRASE>\""
}

• Use quoted exact strings for names, titles, and identifiers.

• Add | only when the user explicitly gives alternatives.

• Add -term only when the user explicitly wants an exclusion.

Advanced keyword syntax with exclusion: Tool: Search_<Entity>

{
  "search_mode": "keyword",
  "query": "\"cyber security operations\" -training"
}

• This returns records containing the exact phrase "cyber security operations" while excluding records that also contain training.

Advanced keyword syntax with grouping: Tool: Search_<Entity>

{
  "search_mode": "keyword",
  "query": "\"cyber security\" + (systems | training)"
}

• This returns records containing the exact phrase "cyber security" and also either systems or training.

Conceptual discovery: Tool: Search_<Entity>

{
  "search_mode": "semantic",
  "query": "<plain-language intent>; <domain synonym 1>; <domain synonym 2>; <domain paraphrase>"
}

• Keep the query in natural language.

• Add only the 2-4 highest-value synonyms or paraphrases.

• Relax narrow constraints only if recall is likely to be too sparse.