Match_all vs *:*

Elastic Stack Elasticsearch
1

Is there any performance difference between using the match_all query vs a
query_string of ":"?

I ask because I'm trying to get a list of documents which match a set of
fields, but want to match all documents. The full query looks like this:

{
"query": {
"filtered": {
"query": {
"query_string": {
"query": ":",
"default_operator": "AND"
}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509",
"e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

or

{
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509",
"e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

Lee

"It doesn't matter whether you are liberal or conservative, but it's
dangerous to always think with exclamation points instead of question
marks."
by Marty Beckerman

2

No, there isn't a big difference (just the parsing of the query_string). Note, I suggest you use and filter and not bool filter, uses less memory.
On Wednesday, March 9, 2011 at 11:04 PM, Lee Parker wrote:
Is there any performance difference between using the match_all query vs a query_string of ":"?

I ask because I'm trying to get a list of documents which match a set of fields, but want to match all documents. The full query looks like this:

{
"query": {
"filtered": {
"query": {
"query_string": {
"query": ":",
"default_operator": "AND"
}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509", "e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

or

{
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509", "e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

Lee

"It doesn't matter whether you are liberal or conservative, but it's dangerous to always think with exclamation points instead of question marks."
by Marty Beckerman

3

I'm using bool here because I may need to filter on multiple fields. Is it
possible to do that without using bool? The documentation doesn't specify
this and if I tried to add more than one filter to the request, it didn't
parse.

Lee

"It doesn't matter whether you are liberal or conservative, but it's
dangerous to always think with exclamation points instead of question
marks."
by Marty Beckerman
On Thu, Mar 10, 2011 at 12:12 AM, Shay Banon
shay.banon@elasticsearch.comwrote:

No, there isn't a big difference (just the parsing of the query_string). Note,
I suggest you use and filter and not bool filter, uses less memory.

On Wednesday, March 9, 2011 at 11:04 PM, Lee Parker wrote:

Is there any performance difference between using the match_all query vs a
query_string of ":"?

I ask because I'm trying to get a list of documents which match a set of
fields, but want to match all documents. The full query looks like this:

{
"query": {
"filtered": {
"query": {
"query_string": {
"query": ":",
"default_operator": "AND"
}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509",
"e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

or

{
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509",
"e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

Lee

"It doesn't matter whether you are liberal or conservative, but it's
dangerous to always think with exclamation points instead of question
marks."
by Marty Beckerman

4

I meant and filter: Elasticsearch Platform — Find real-time answers at scale | Elastic (And also or and not).
On Thursday, March 31, 2011 at 5:52 PM, Lee Parker wrote:

I'm using bool here because I may need to filter on multiple fields. Is it possible to do that without using bool? The documentation doesn't specify this and if I tried to add more than one filter to the request, it didn't parse.

Lee

"It doesn't matter whether you are liberal or conservative, but it's dangerous to always think with exclamation points instead of question marks."
by Marty Beckerman
On Thu, Mar 10, 2011 at 12:12 AM, Shay Banon shay.banon@elasticsearch.com wrote:

No, there isn't a big difference (just the parsing of the query_string). Note, I suggest you use and filter and not bool filter, uses less memory.
On Wednesday, March 9, 2011 at 11:04 PM, Lee Parker wrote:

Is there any performance difference between using the match_all query vs a query_string of ":"?

I ask because I'm trying to get a list of documents which match a set of fields, but want to match all documents. The full query looks like this:

{
"query": {
"filtered": {
"query": {
"query_string": {
"query": ":",
"default_operator": "AND"
}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509", "e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

or

{
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509", "e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

Lee

"It doesn't matter whether you are liberal or conservative, but it's dangerous to always think with exclamation points instead of question marks."
by Marty Beckerman

5

Ahh. Can you nest "and" and "not" filters? I can't tell from the
documentation if that is possible.

Lee

"It doesn't matter whether you are liberal or conservative, but it's
dangerous to always think with exclamation points instead of question
marks."
by Marty Beckerman
On Thu, Mar 31, 2011 at 11:21 AM, Shay Banon
shay.banon@elasticsearch.comwrote:

I meant and filter:
Elasticsearch Platform — Find real-time answers at scale | Elastic (And
also or and not).

On Thursday, March 31, 2011 at 5:52 PM, Lee Parker wrote:

I'm using bool here because I may need to filter on multiple fields. Is it
possible to do that without using bool? The documentation doesn't specify
this and if I tried to add more than one filter to the request, it didn't
parse.

Lee

"It doesn't matter whether you are liberal or conservative, but it's
dangerous to always think with exclamation points instead of question
marks."
by Marty Beckerman
On Thu, Mar 10, 2011 at 12:12 AM, Shay Banon <shay.banon@elasticsearch.com

wrote:

No, there isn't a big difference (just the parsing of the query_string). Note,
I suggest you use and filter and not bool filter, uses less memory.

On Wednesday, March 9, 2011 at 11:04 PM, Lee Parker wrote:

Is there any performance difference between using the match_all query vs a
query_string of ":"?

I ask because I'm trying to get a list of documents which match a set of
fields, but want to match all documents. The full query looks like this:

{
"query": {
"filtered": {
"query": {
"query_string": {
"query": ":",
"default_operator": "AND"
}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509",
"e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

or

{
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509",
"e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

Lee

"It doesn't matter whether you are liberal or conservative, but it's
dangerous to always think with exclamation points instead of question
marks."
by Marty Beckerman

6

Sure, within a not filter, for example, you can place any other filter. Within an and filter, you can place any number (and types) of other filters.
On Thursday, March 31, 2011 at 6:25 PM, Lee Parker wrote:

Ahh. Can you nest "and" and "not" filters? I can't tell from the documentation if that is possible.

Lee

"It doesn't matter whether you are liberal or conservative, but it's dangerous to always think with exclamation points instead of question marks."
by Marty Beckerman
On Thu, Mar 31, 2011 at 11:21 AM, Shay Banon shay.banon@elasticsearch.com wrote:

I meant and filter: Elasticsearch Platform — Find real-time answers at scale | Elastic (And also or and not).
On Thursday, March 31, 2011 at 5:52 PM, Lee Parker wrote:

I'm using bool here because I may need to filter on multiple fields. Is it possible to do that without using bool? The documentation doesn't specify this and if I tried to add more than one filter to the request, it didn't parse.

Lee

"It doesn't matter whether you are liberal or conservative, but it's dangerous to always think with exclamation points instead of question marks."
by Marty Beckerman
On Thu, Mar 10, 2011 at 12:12 AM, Shay Banon shay.banon@elasticsearch.com wrote:

No, there isn't a big difference (just the parsing of the query_string). Note, I suggest you use and filter and not bool filter, uses less memory.
On Wednesday, March 9, 2011 at 11:04 PM, Lee Parker wrote:

Is there any performance difference between using the match_all query vs a query_string of ":"?

I ask because I'm trying to get a list of documents which match a set of fields, but want to match all documents. The full query looks like this:

{
"query": {
"filtered": {
"query": {
"query_string": {
"query": ":",
"default_operator": "AND"
}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509", "e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

or

{
"query": {
"filtered": {
"query": {
"match_all": {}
},
"filter": {
"bool": {
"must": [{
"term": {
"campaign_id": "1"
}
}, {
"terms": {
"hash": ["4f7b7b2f105b8b6951f919e657ca6509", "e44036caa080c94b91aab963bfccc8c8"]
}
}]
}
}
}
},
"size": 30,
"from": 0,
"sort": [{
"date": {
"reverse": true
}
}, "_score"]
}

Lee

"It doesn't matter whether you are liberal or conservative, but it's dangerous to always think with exclamation points instead of question marks."
by Marty Beckerman