Hi, I am using Elastic search 2.2.0 for analytics in a high scale environment. I am facing a problem to choose a better query code which will give me a better performance.
I am also having 10-15 other queries which will be using same type of filtering, but the aggregations will be on different fields.
Should I use "filter" in query clause for filtering or should filter documents using "must"?
Please give me suggestions to get better performance when query is executed.
Herewith, I am placing a query with two sample formats:
- Format using 'must' to filter the data in query clause
{
"size": 0,
"query": {
"bool": {
"must": [
{
"match": {
"type": "type1"
}
},
{
"exists": {
"field": "sample_field"
}
}
]
}
},
"aggs": {
"group_by_state": {
"terms": {
"field": "grouping_field",
"size": 0
},
"aggs": {
"_time": {
"terms": {
"field": "data_time",
"size": 0
},
"aggs": {
"Max_value": {
"max": {
"field": "field2"
}
}
}
}
}
}
}
}
2.Format using 'filter' and 'must' to filter the data in query clause
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"term": {
"type": "type1"
}
},
{
"exists": {
"field": "sample_field"
}
}
],
}
},
"aggs": {
"group_by_state": {
"terms": {
"field": "grouping_field",
"size": 0
},
"aggs": {
"_time": {
"terms": {
"field": "data_time",
"size": 0
},
"aggs": {
"Max_value": {
"max": {
"field": "field2"
}
}
}
}
}
}
}
}