--- title: "Boolean Search: How AND, OR, and NOT Work | Ceisium" description: "Learn Boolean search with practical docs examples for AND, OR, NOT, parentheses, filters, text analysis, and the boundary between retrieval and ranking." canonical: https://ceisium.com/blog/boolean-retrieval/ --- > For the complete documentation and public content index, see [llms.txt](/llms.txt). This page is the Markdown alternative to the canonical HTML page. ![Five documentation cards pass through Boolean set paths and become three search candidates.](https://ceisium.com/blog/boolean-retrieval-cover.webp) Five documentation cards pass through Boolean set paths and become three search candidates. ![Five documentation cards pass through Boolean set paths and become three search candidates.](https://ceisium.com/blog/boolean-retrieval-cover.webp) Five documentation cards pass through Boolean set paths and become three search candidates. 1. [Home](https://ceisium.com/) 2. / 3. [Blog](https://ceisium.com/blog/) 4. / 5. Boolean Retrieval: AND, OR, and NOT in Search Published July 21, 2026 Updated August 9, 2026 # Boolean Retrieval: AND, OR, and NOT in Search Learn how Boolean search uses AND, OR, and NOT to combine result sets, where exact control helps, and why website search still needs ranking. [![](https://ceisium.com/blog/share-icons/x.webp)](https://twitter.com/intent/tweet?text=Boolean%20Retrieval%3A%20AND%2C%20OR%2C%20and%20NOT%20in%20Search&url=https%3A%2F%2Fceisium.com%2Fblog%2Fboolean-retrieval%2F)[![](https://ceisium.com/blog/share-icons/linkedin.webp) ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fceisium.com%2Fblog%2Fboolean-retrieval%2F)[![](https://ceisium.com/blog/share-icons/hacker-news.webp)](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fceisium.com%2Fblog%2Fboolean-retrieval%2F&t=Boolean%20Retrieval%3A%20AND%2C%20OR%2C%20and%20NOT%20in%20Search) [Search](https://ceisium.com/blog/?tag=Search) [Learn](https://ceisium.com/blog/?tag=Learn) Search does not always need to infer a user’s meaning. Sometimes the user knows which words are necessary or not permitted. For example: TEXT ``` api AND authenticationinvoice OR receiptwebhook AND NOT legacy ``` These are Boolean queries. Boolean retrieval uses a match-or-no-match model. We will use a small documentation site as an example. First, Boolean operators select the matching pages. Then, the ranking system orders those pages. ## What is Boolean retrieval? Boolean retrieval finds documents that satisfy logical conditions. Each query term has a set of matching documents. Boolean operators combine those sets: - `AND` keeps documents that occur in both sets. - `OR` keeps documents that occur in either set or both sets. - `NOT B` keeps documents outside set B in a defined search universe. - `A AND NOT B` removes set B from set A. A document satisfies the Boolean condition, or it does not. Boolean operators give users direct control when they know which documents are acceptable. Boolean retrieval defines the matching logic. The search engine defines the query syntax, supported operators, and scoring behavior. ## A five-page documentation site All examples use the following five pages. A full-text search system usually analyzes page text before it searches. It converts selected text into indexed terms. The system also converts the query into compatible terms. It then gets the document set for each query term. For example: TEXT ``` Raw page text: "Create API keys"Indexed terms: api, keyMatch set for key: {D1, D2, D5} ``` The **Complete indexed terms** column contains all indexed terms for each page. ID Page Representative text Complete indexed terms D1 Create API keys Create API keys; authenticated request. `create`, `api`, `key`, `authenticated`, `request` D2 API authentication API authentication; bearer token; key. `api`, `authentication`, `bearer`, `token`, `key` D3 Verify webhook signatures Webhook authentication; signing secret. `webhook`, `authentication`, `signing`, `secret` D4 Retry failed webhooks Retry failed webhook delivery. `retry`, `failed`, `webhook`, `delivery` D5 Legacy API key migration Legacy API key migration; deprecated. `legacy`, `api`, `key`, `migration`, `deprecated` The example analyzer does these operations: - It converts uppercase letters to lowercase. - It removes punctuation. - It reduces simple plurals such as `keys` to `key`. - It does not stem other words or add synonyms. These are the match sets: TEXT ``` api -> {D1, D2, D5}key -> {D1, D2, D5}authentication -> {D2, D3}webhook -> {D3, D4}retry -> {D4}legacy -> {D5} ``` The search engine can get these sets from an [inverted index ![](https://ceisium.com/blog/inverted-index-cover.webp)Search / Jul 15, 2026 What Is an Inverted Index? An inverted index maps terms to the documents that contain them, helping search engines find text matches without scanning every page.](https://ceisium.com/blog/what-is-an-inverted-index/) . The index records the documents that contain each term. ## AND means intersection `AND` requires both conditions. It does not require adjacent words. Exact phrase matching is a separate feature. Use this query: TEXT ``` api AND authentication ``` The `api` set is `{D1, D2, D5}`. The `authentication` set is `{D2, D3}`. `AND` keeps their intersection: TEXT ``` {D1, D2, D5} ∩ {D2, D3} = {D2} ``` Only D2 matches. D1 does not contain `authentication`, and D3 does not contain `api`. Now use this query: TEXT ``` webhook AND authentication ``` The two sets are: TEXT ``` webhook -> {D3, D4}authentication -> {D2, D3} ``` Their intersection is `{D3}`. `AND` usually makes the result set smaller. Each added condition removes documents that do not satisfy it. An `AND` condition can make a broad query more precise. ## OR means union Boolean `OR` is usually inclusive. A document can satisfy the left clause, the right clause, or both clauses. Use this query: TEXT ``` api OR authentication ``` The sets overlap at D2: TEXT ``` api -> {D1, D2, D5}authentication -> {D2, D3} ``` `OR` combines the sets: TEXT ``` {D1, D2, D5} ∪ {D2, D3} = {D1, D2, D3, D5} ``` D2 occurs once in the result set. D1 and D5 match `api`, and D3 matches `authentication`. `OR` usually makes the set larger. It is useful when two terms are acceptable alternatives: TEXT ``` invoice OR receipterror OR failureremove OR delete ``` The query lists the acceptable alternatives. Do not assume that the engine knows they are related. ## NOT means exclusion `NOT` starts with a defined search universe. It keeps the documents outside the excluded set. Our complete universe is: TEXT ``` U = {D1, D2, D3, D4, D5} ``` This query removes the `legacy` set: TEXT ``` NOT legacy ``` The result is: TEXT ``` U - {D5} = {D1, D2, D3, D4} ``` Now use: TEXT ``` api AND NOT legacy ``` The `api` set is `{D1, D2, D5}`. Remove D5 because it contains `legacy`: TEXT ``` {D1, D2, D5} - {D5} = {D1, D2} ``` Some query languages permit `api NOT legacy`. Others require `api AND NOT legacy`. Some languages do not permit a standalone `NOT` query. The parser grammar controls the valid forms. The search universe needs a clear boundary. NOT uses a selected collection as its universe. It does not use all documents everywhere. The universe can be one site, project, language, or collection. Without this boundary, `NOT legacy` has no complete set to search. ![Black llama-head blob sorts documentation cards through AND intersection, inclusive OR, and NOT exclusion sets.](https://ceisium.com/blog/boolean-retrieval/operator-sets.webp) AND keeps the overlap. Inclusive OR keeps either side or both. NOT removes an excluded set from a defined universe. ![Black llama-head blob sorts documentation cards through AND intersection, inclusive OR, and NOT exclusion sets.](https://ceisium.com/blog/boolean-retrieval/operator-sets.webp) AND keeps the overlap. Inclusive OR keeps either side or both. NOT removes an excluded set from a defined universe. ## Parentheses show the intended order A query can contain several operators: TEXT ``` api OR webhook AND authentication ``` The query has two possible meanings. The first meaning is: TEXT ``` (api OR webhook) AND authentication ``` `api OR webhook` matches all five pages. The `authentication` condition reduces this set to `{D2, D3}`. The second meaning is: TEXT ``` api OR (webhook AND authentication) ``` `webhook AND authentication` matches D3. The final union is `{D1, D2, D3, D5}`. The two groupings return different document sets. Many Boolean systems apply `NOT` before `AND` and `AND` before `OR`. Do not assume that every product uses this order. Parsers can use different precedence rules, case rules, or symbols. Parentheses show the intended grouping. Use explicit parentheses for mixed operators. Also, use the syntax in the product documentation. ## Results from the example corpus Query Matching pages `api AND key` D1, D2, D5 `webhook AND authentication` D3 `api OR authentication` D1, D2, D3, D5 `api AND NOT legacy` D1, D2 `NOT legacy` D1, D2, D3, D4 `(api OR webhook) AND authentication` D2, D3 `api OR (webhook AND authentication)` D1, D2, D3, D5 ## Text analysis changes the input sets Boolean matching usually operates on analyzed terms, not direct character strings. An analyzer can do these operations: - Convert text to lowercase - Split text into tokens - Remove punctuation - Reduce words to a common root - Remove common words - Expand synonyms - Apply language rules Our analyzer changes `API keys` to `api` and `key`. Thus, `key` can match a page that contains `keys`. The analyzer does not connect `authenticated` to `authentication`. Therefore, D1 is absent from the `authentication` set. A different stemmer can produce this larger set: TEXT ``` authentication -> {D1, D2, D3} ``` The Boolean logic is unchanged. `AND` still calculates an intersection. The analyzer changed the input sets. TEXT ``` Analyzer: Which indexed terms match this query clause?Boolean logic: How should the match sets combine? ``` You must know both parts to explain a Boolean result. ## Text clauses and structured filters are different A Boolean text clause searches analyzed content: TEXT ``` api AND key ``` A structured filter checks exact field values or metadata. This example is pseudocode, not portable syntax: TEXT ``` section = "guides"version = "v2"language = "python" ``` Text clauses can search titles, headings, and body content. Filters can check product, version, language, category, date, or workspace. A request can use both: TEXT ``` Text query:(api AND key) AND NOT legacyFilters:version = "v2"section = "guides" ``` The text query checks analyzed terms. The filters restrict the candidates with structured data. Authorization is a mandatory system constraint. User query syntax must not weaken it. For one user, the search universe must contain only permitted documents. A user-controlled `NOT private` clause is not access control. ## Useful cases for Boolean retrieval Boolean retrieval works well when the user knows precise terms. ### Require an important term TEXT ``` webhook AND authentication ``` This query removes general webhook pages that do not discuss authentication. ### Accept two names TEXT ``` member AND (remove OR delete) ``` The alternatives can find pages that use either verb. ### Exclude marked old content TEXT ``` api AND key AND NOT legacy ``` The query works only when `legacy` is a reliable marker. Structured version data is safer when it is available. ### Search exact technical terms Boolean clauses can combine error codes, function names, product names, fields, and protocols. TEXT ``` ERR_AUTH_42 AND webhook ``` The analyzer controls whether `ERR_AUTH_42` stays one term. Use the engine’s exact field and syntax when the complete identifier is necessary. ### Build advanced search controls An interface can provide these controls: TEXT ``` Must containMay containMust not contain ``` The interface can convert them to Boolean clauses. Users do not need to learn the raw syntax. ## Candidate selection is not ranking Boolean retrieval answers one question: Which documents can match? Boolean retrieval does not always answer a second question: Which matching document must appear first? The query `api AND key` matches D1, D2, and D5. Basic Boolean logic treats all three as matches. A ranker can then use term frequency, title matches, or other evidence to set the order. [BM25 ![](https://ceisium.com/blog/bm25-cover-ceisium-bottom-right-aligned.webp)Search / Jun 24, 2026 What is BM25? A Plain English Guide BM25 is a keyword search ranking function that scores documents using term frequency, term rarity, and document length. Learn how it works, where it helps, and how it differs from TF-IDF.](https://ceisium.com/blog/what-is-bm25/) is one method for lexical ranking. A system can enforce Boolean conditions and then rank the permitted documents. Some engines also let scored Boolean clauses affect the order. Check the documented behavior of your engine. ![Black llama-head blob carries one of three eligible documentation cards from a Boolean gate to an ordered result stack.](https://ceisium.com/blog/boolean-retrieval/candidates-need-order.webp) Boolean logic defines the eligible set. A ranker then decides which candidate appears first. ![Black llama-head blob carries one of three eligible documentation cards from a Boolean gate to an ordered result stack.](https://ceisium.com/blog/boolean-retrieval/candidates-need-order.webp) Boolean logic defines the eligible set. A ranker then decides which candidate appears first. Boolean conditions select documents. Ranking signals put them in order. Candidate selection and result order answer different questions. ## Limits of Boolean retrieval Boolean retrieval gives control, but the user must select useful terms. This query can be too strict: TEXT ``` api AND authentication AND bearer AND rotation ``` The result is empty if no page contains every analyzed term. This query can be too broad: TEXT ``` api OR authentication OR request OR token ``` Common terms can admit many weak candidates. `NOT` also needs care. `python NOT legacy` removes a current page that only mentions a legacy comparison. Boolean retrieval does not solve all vocabulary differences. `remove teammate` can miss a page named `Delete workspace member`. An analyzer, synonym rule, or explicit alternative can connect those terms. Search engines can also support phrases, proximity, field rules, wildcards, and fuzzy matching. Boolean operators do not define those features. ## Summary Boolean retrieval combines document sets: - `AND` calculates an intersection. - `OR` calculates an inclusive union. - `NOT` excludes a set from a defined universe. - Parentheses show the intended order for mixed operators. - Text analysis determines which documents enter each term set. - Structured filters operate on fields and metadata. - Authorization defines a mandatory permitted universe. - Boolean logic selects candidates, and ranking puts them in order. In our five-page corpus, `api AND NOT legacy` returns D1 and D2. D5 contains `api`, but the `legacy` condition removes it. Boolean retrieval has two steps. First, build the match sets. Then, combine them with explicit logical rules. [![](https://ceisium.com/blog/share-icons/x.webp)](https://twitter.com/intent/tweet?text=Boolean%20Retrieval%3A%20AND%2C%20OR%2C%20and%20NOT%20in%20Search&url=https%3A%2F%2Fceisium.com%2Fblog%2Fboolean-retrieval%2F)[![](https://ceisium.com/blog/share-icons/linkedin.webp) ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fceisium.com%2Fblog%2Fboolean-retrieval%2F)[![](https://ceisium.com/blog/share-icons/hacker-news.webp)](https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fceisium.com%2Fblog%2Fboolean-retrieval%2F&t=Boolean%20Retrieval%3A%20AND%2C%20OR%2C%20and%20NOT%20in%20Search) Copy image[](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fceisium.com%2Fblog%2Fboolean-retrieval%2F)[](https://twitter.com/intent/tweet?text=%E2%80%9CBoolean%20Retrieval%3A%20AND%2C%20OR%2C%20and%20NOT%20in%20Search%E2%80%9D&url=https%3A%2F%2Fceisium.com%2Fblog%2Fboolean-retrieval%2F) **Yuvraj** _Building Ceisium and working on growth @ SigNoz_ ceisium.com ## Next reads [ ![A term dictionary sends one highlighted term through posting lists to matching document nodes.](https://ceisium.com/blog/inverted-index-cover.webp) What Is an Inverted Index? An inverted index maps terms to the documents that contain them, helping search engines find text matches without scanning every page. ](https://ceisium.com/blog/what-is-an-inverted-index/)[ ![BM25 scores query terms using rarity, repetition, and document length signals.](https://ceisium.com/blog/bm25-cover-ceisium-bottom-right-aligned.webp) What is BM25? A Plain English Guide BM25 is a keyword search ranking function that scores documents using term frequency, term rarity, and document length. Learn how it works, where it helps, and how it differs from TF-IDF. ](https://ceisium.com/blog/what-is-bm25/)