Hi all,
I'm taking a closer look at how Kibana actually build the search for visualizations and discoveries.
What I can figure out is that every queries and Kibana filters are translated into a must clause in the generated json search. I would like Kibana to generate searches with filter context in a bool filter clause instead of a bool must clause. This way, I'll be able to benefit from the Node Query Cache (filter cache) hoping it will speed up a bit the load of my dashboards. Indeed, for my use-case, most of the visualizations filter on the same tag .
Even if I specify myself in the visualization the Kibana (6.8) filter as :
{
"query": {
"bool": {
"filter": {
"term": {
"tags.keyword": "my_tag"
}
}
}
}
}
it will end up in something like :
{
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"match_all": {}
},
{
"bool": {
"filter": {
"term": {
"tags.keyword": "my_tag"
}
}
}
},
{
"range": {
"@timestamp": {
"gte": 1562852272157,
"lte": 1563457072158,
"format": "epoch_millis"
}
}
},
{
"bool": {
"filter": {
"term": {
"tags.keyword": "my_tag"
}
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
which is not what I expect because the filter clause remains empty. I'm not sure if a nested filter in a must clause will give the same performance result.
How to force (somehow) Kibana to use a filter context to benefit from the Node Query Cache and avoid computing score or did I miss-understood something?
Cheers