Filter aggregation vs Term aggregation with filtering values

I'm building aggregations on a field which has bot a '.analyzed' and a
'.raw' version.
The analyzer used is the standard analyzer

If I want to build filtered term buckets, what would be more performant

  1. Using an 'include' specified on the terms aggregation on the '.raw'
    field (
  2. Using a filter aggregation on the '.analyzed' version, then building the
    terms aggregation on the '.raw' field.

How will the performance change

  1. If the field is really large
  2. If the field is small (< 300 characters)

I know that the semantics of querying on a analyzed field differs from a
regex match; but if my users would be okay either way - what is the query
which will have better perf on the cluster ?

You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
To view this discussion on the web visit
For more options, visit