Difference between two facets

Elastic Stack Elasticsearch
1

Hi all,

Can someone help me understand why we get different results form the
following two queries (or tell me where I can find an explanation)

{
"from" : 0, "size" : 0,
"query": {
"filtered": {
"query": {
"term": {
"@fields.check_id":
"680c814c-9d97-42e5-8d6f-a463195c98cf"
}
},
"filter": {
"range": {
"@timestamp": {
"from": "now-1M",
"to": "now"
}
}
}
}
},
"facets": {
"uptime": {
"terms": {
"field": "@fields.result"
}
}
}
}

and this

{
"from" : 0, "size" : 0,
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"range": {
"@timestamp": {
"from": "now-1M",
"to": "now"
}
}
}
}
},
"facets": {
"uptime": {
"terms": {
"field": "@fields.result"
},
"facet_filter": {
"term": {
"@fields.check_id":
"680c814c-9d97-42e5-8d6f-a463195c98cf"
}
}
}
}
}

Thanks,
Jurg.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

As far as I know,
the first query would only facet on 680c814c-9d97-42e5-8d6f-a463195c98cf.
Your second facet calculation will not
include 680c814c-9d97-42e5-8d6f-a463195c98cf, which is opposite, you might
confuse with
filter facet.

On Monday, June 10, 2013 1:27:27 PM UTC-7, Jurg van Vliet wrote:

Hi all,

Can someone help me understand why we get different results form the
following two queries (or tell me where I can find an explanation)

{
"from" : 0, "size" : 0,
"query": {
"filtered": {
"query": {
"term": {
"@fields.check_id":
"680c814c-9d97-42e5-8d6f-a463195c98cf"
}
},
"filter": {
"range": {
"@timestamp": {
"from": "now-1M",
"to": "now"
}
}
}
}
},
"facets": {
"uptime": {
"terms": {
"field": "@fields.result"
}
}
}
}

and this

{
"from" : 0, "size" : 0,
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"range": {
"@timestamp": {
"from": "now-1M",
"to": "now"
}
}
}
}
},
"facets": {
"uptime": {
"terms": {
"field": "@fields.result"
},
"facet_filter": {
"term": {
"@fields.check_id":
"680c814c-9d97-42e5-8d6f-a463195c98cf"
}
}
}
}
}

Thanks,
Jurg.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Hi Jurg,

The facet part should return the same. The difference is in the hits
section of the result.

When you use a filter within the query clause, it modifies the set of
documents that the query matches. This means that both the hits section and
the facet get affected by it.

Putting the filter as a facet_filter under a facet means that the set of
document is filtered before being analysed but this has affect only on
this specific facet, not the query results.

Does this explain what you are seeing?

Cheers,
Boaz

On Monday, June 10, 2013 10:27:27 PM UTC+2, Jurg van Vliet wrote:

Hi all,

Can someone help me understand why we get different results form the
following two queries (or tell me where I can find an explanation)

{
"from" : 0, "size" : 0,
"query": {
"filtered": {
"query": {
"term": {
"@fields.check_id":
"680c814c-9d97-42e5-8d6f-a463195c98cf"
}
},
"filter": {
"range": {
"@timestamp": {
"from": "now-1M",
"to": "now"
}
}
}
}
},
"facets": {
"uptime": {
"terms": {
"field": "@fields.result"
}
}
}
}

and this

{
"from" : 0, "size" : 0,
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"range": {
"@timestamp": {
"from": "now-1M",
"to": "now"
}
}
}
}
},
"facets": {
"uptime": {
"terms": {
"field": "@fields.result"
},
"facet_filter": {
"term": {
"@fields.check_id":
"680c814c-9d97-42e5-8d6f-a463195c98cf"
}
}
}
}
}

Thanks,
Jurg.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.