Snowflake Cortex Search Deep Dive: Hybrid Search and RAG Patterns

Snowflake Cortex Search delivers hybrid retrieval — fusing keyword and semantic search — as a fully managed service. Embedding generation, index building, and score fusion are all automated, so you only need a single CREATE CORTEX SEARCH SERVICE statement to add high-quality search to your application. Used as a Retrieval-Augmented Generation (RAG) retriever, it pairs cleanly with Cortex LLM functions to power internal document Q&A systems.

What Hybrid Search Means

The hybrid search behind Cortex Search internally blends two complementary retrieval techniques.

Search flow:

[User query: "Snowflake data protection features"]
       │
       ├──→ keyword search ──→ BM25 score
       │     └─ scans the inverted index for "Snowflake", "data", "protection"
       │
       ├──→ semantic search ──→ vector similarity score
       │     └─ embeds the query -> approximate nearest neighbour search
       │
       └──→ score fusion (Reciprocal Rank Fusion)
              └─ returns the final ranking

CREATE CORTEX SEARCH SERVICE

You create a Cortex Search service with DDL, specifying the source table, the column to search, optional filter columns, and the refresh cadence.

CREATE OR REPLACE CORTEX SEARCH SERVICE knowledge_base_search
  ON doc_content                    -- the text column to search
  ATTRIBUTES doc_title, category    -- columns available for filtering (optional)
  WAREHOUSE = search_wh             -- warehouse used to build the index
  TARGET_LAG = '1 hour'             -- how far behind the source data may be
AS (
  SELECT
    doc_id,
    doc_title,
    doc_content,
    category,
    updated_at
  FROM knowledge_base
  WHERE is_published = TRUE
);

Key Parameters

Running Search Queries

You query a Cortex Search service through the Python SDK (recommended) or the REST API.

# Searching from the Python SDK
from snowflake.core import Root

root = Root(session)

search_service = (
    root.databases["MY_DB"]
    .schemas["PUBLIC"]
    .cortex_search_services["KNOWLEDGE_BASE_SEARCH"]
)

results = search_service.search(
    query="About Snowflake's Time Travel feature",
    columns=["doc_id", "doc_title", "doc_content", "category"],
    filter={
        "@eq": {"category": "data_protection"}
    },
    limit=5
)

for result in results.results:
    print(f"Title: {result['doc_title']}")
    print(f"Score: {result['search_score']}")
    print(f"Content: {result['doc_content'][:200]}...")
    print("---")

Filter Syntax

The following filter operators are available on columns listed in ATTRIBUTES.

# Exact match
{"@eq": {"category": "security"}}

# OR (multiple values)
{"@or": [
  {"@eq": {"category": "security"}},
  {"@eq": {"category": "governance"}}
]}

# AND
{"@and": [
  {"@eq": {"category": "security"}},
  {"@eq": {"doc_type": "guide"}}
]}

Using Cortex Search as a RAG Retriever

By wiring Cortex Search as the retriever in front of Cortex LLM functions, you can build a RAG pipeline grounded in your internal knowledge base.

RAG pipeline:

[User question]
       │
       ▼
[Cortex Search]  <- retriever
       │ retrieve the Top-K related documents
       ▼
[Build the prompt]
       │ "Answer based on the following context:
       │  {doc_content from the search results}"
       ▼
[SNOWFLAKE.CORTEX.COMPLETE()]  <- generator
       │ generate the answer with the context attached
       ▼
[Return the answer to the user]

# Example RAG pipeline (Streamlit in Snowflake)
import streamlit as st
from snowflake.core import Root
from snowflake.snowpark.context import get_active_session

session = get_active_session()
root = Root(session)

search_service = (
    root.databases["KB_DB"]
    .schemas["PUBLIC"]
    .cortex_search_services["KB_SEARCH"]
)

user_question = st.text_input("Enter your question")

if user_question:
    # Step 1: retrieve related documents with Cortex Search
    results = search_service.search(
        query=user_question,
        columns=["doc_content"],
        limit=3
    )

    context = "\n\n".join([r["doc_content"] for r in results.results])

    # Step 2: generate the answer with the COMPLETE function
    prompt = f"""Answer the question using only the context below.
If the context does not contain the information, answer \"I could not find that information\".

Context:
{context}

Question: {user_question}"""

    answer = session.sql(
        "SELECT SNOWFLAKE.CORTEX.COMPLETE('llama3.1-70b', ?)",
        params=[prompt]
    ).collect()[0][0]

    st.write(answer)

Cost Model

• Index build: consumes credits on the warehouse you specify
• Incremental index refresh: consumes serverless credits, scaled to TARGET_LAG
• Search query execution: consumes serverless credits (no warehouse needed)
• Storage: standard storage charges apply to the index data

Cortex Search vs. Other Approaches

Exam Prep Highlights

• Cortex Search is a hybrid keyword + semantic search service
• CREATE CORTEX SEARCH SERVICE specifies ON (search target) and TARGET_LAG (refresh cadence)
• Search queries run on serverless compute — no warehouse required
• Columns listed in ATTRIBUTES are usable for metadata filtering
• In RAG pipelines, pair it as the retriever with the COMPLETE function
• Understand how it differs from manual vector search built on the VECTOR type

Sample Question

Frequently Asked Questions