Facet search not working

Elastic Stack Elasticsearch
1

Hi,

I'm trying to build a facets search where i need to retrieve only the facets count data.
This search needs to be on a date range and to match some fields values.

That's my mapping:

{
"mappings": {
"log": {
"properties": {
"session": {"type": "string"},
"visitor": {"type": "string"},
"bot": {"type": "integer"},
"site": {"type": "integer"},
"access": {"type": "date", "format" : "yyyy-MM-dd HH:mm:ss"},
"request": {"type": "string", "index" : "not_analyzed"},
"referer": {"type": "string", "index" : "not_analyzed"},
"first": {"type": "integer"},
"ip": {"type": "ip"},
"user_agent": {"type": "string"},
"city": {"type": "string", "index" : "not_analyzed"},
"country": {"type": "string", "index" : "not_analyzed"},
"ll": {"type": "geo_point"}
}
}
}
}

And that's my search, i'm sure that i made something wrong to the criteria (terms and range) be true to only retrieve data from that range, and bot=0 and site=49210 and first=1

I'm new using ES, but only reading the documentation doesn't helped to understand my error on this query.

{
"query" : {
"filtered" : {
"filter" : {
"range" : {
"access" : {
"to" : "2013-09-12 23:59:59",
"from":"2013-09-12 00:00:00"
}
}
},
"query" : {
"term" : {
"bot" : "0"
}
},
"query" : {
"term" : {
"site" : "49210"
}
},
"query" : {
"term" : {
"first" : "1"
}
}
}
},
"facets" : {
"request" : {
"terms" : {
"field" : "referer",
"size" : "10",
"exclude" : ["",null]
}
}
},
"size" : "0"
}

2

I think i made it, but i'm not sure if is the best solution, here it is:

{
"query" : {
"filtered" : {
"filter" : {
"and" : [
{
"range" : {
"access" : {
"to" : "2013-09-12 23:59:59",
"from":"2013-09-12 00:00:00"
}
}
},
{
"term" : {
"bot" : "0"
}
},
{
"term" : {
"site" : "49210"
}
},
{
"term" : {
"first" : "1"
}
}
]
}
}
},
"facets" : {
"request" : {
"terms" : {
"field" : "referer",
"size" : "10",
"exclude" : ["",null]
}
}
},
"size" : "0"
}

3

Hi Ricardo

You're pretty much there, but there are a few things worth mentioning (see
my query below):

  1. use search_type=count to just return the count and the facets, no search
    results
  2. use a bool filter rather than an and filter - it plays better with
    bitset filters like range and term
  3. you're faceting on a string field with high cardinality. this field
    value needs to be loaded into memory for ALL docs in the index, not just
    the ones that match your query. this is likely to use a lot of memory!

clint

curl localhost:9200/_search?search_type=count -d '
{
"query": {
"filtered": {
"filter": {
"bool": {
"must": [
{
"range": {
"access": {
"gte": "2013-09-12 00:00:00",
"lt": "2013-09-13 00:00:00"
}
}
},
{
"term": {
"bot": 0
}
},
{
"term": {
"site": 49210
}
},
{
"term": {
"first": 1
}
}
]
}
}
}
},
"facets": {
"request": {
"terms": {
"field": "referer"
}
}
}
}'

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.