# Performance different if searching on normal or keyword field?

**URL:** https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692
**Category:** Elasticsearch
**Created:** [March 15, 2017, 11:40am UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692 "2017-03-15T11:40:44Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [March 15, 2017, 11:40am UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692/1 "2017-03-15T11:40:44Z")

</div>

Hi,

is there a difference in performance / cpu usage if I search **for the complete string** of a field or if i search on the .keyword field?

example:

_type: myLog1_

versus

_type.keyword: mylog1_

thanks, Andreas

---

<div class="post-metadata">

### Author: ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [March 15, 2017, 4:03pm UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692/2 "2017-03-15T16:03:25Z")

</div>

> [@asp](#):
>
> is there a difference in performance / cpu usage if I search for the complete string of a field or if i search on the .keyword field?
> 
> example:
> 
> type: myLog1
> 
> versus
> 
> type.keyword: mylog1

Hi Andreas,

I'm not sure I can confidently answer this question but I will try. My assumption is searching on the field without keyword will have to run the query through Elasticsearch's analyzer, and then match with the parsed out fields will take some extra CPU. But I don't know the internal of ES well enough to know for sure. I will keep an eye out for your question and get back to you.

Thanks  
Rashmi

---

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [March 15, 2017, 4:05pm UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692/3 "2017-03-15T16:05:35Z")

</div>

thanks for the update

---

<div class="post-metadata">

### Author: ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [March 15, 2017, 4:29pm UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692/4 "2017-03-15T16:29:12Z")

</div>

Hi Asp

As I understand your question more, here is what I think. The keyword field will be faster since it only needs to find one term in the inverted index, whereas the text field will need to search for each individual term.But in your example there won't be much difference since for both fields there will only be one term to search. If the example was `type:"This is myLog1 file"` and `type.keyword:"This is myLog1 file"` then the keyword would be faster.

In terms of how fast it can be, it really depends on a lot of different factors but in my mind I simplify it down to how many individual entries in the inverted index you are asking the query to visit. In the case of a keyword field it is always 1 since the search is for a single term which is the entire text. In the case of the text field the number of terms that need to be visited is determined by the search text and also the analyzer thats applied to the field, so could be any number of terms `n`. If you consider each visit of a term to require a fixed amount of time/CPU `t` (this is an oversimplification since there are some optimizations in multi term searching) then the keyword search will always require `1 x t` but the text field will require `n x t`. Hope this explanation helps.

Thanks  
Rashmi

---

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [March 15, 2017, 4:49pm UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692/5 "2017-03-15T16:49:26Z")

</div>

Ok, thanks a lot. I also thought in this direction, but I wanted to be sure 😉

Then I have one additional question which is enhancing the original one.

I opnened a different thread for it, but I assume I can answer it with the details you provided:

> [@Optimize search speed / resource usage by writing good queries?](https://discuss.elastic.co/t/optimize-search-speed-resource-usage-by-writing-good-queries/78695):
>
> Hi, I would like to increase my the search speed in kibana. Since I am not that familar with lucene indexes / elasticsearch yet, I would like to ask you for your opinion. Searching is real easy via kibana. Just type in a word and all events containing the word are given back. Now my events have several fields, just like type, payload, message, username, etc. For example, if I am searching for a username, does it improve the speed if I search for: username: xyz instead of searching for xyz? …

So if my event has multiple fileds: message, payload, field **1**... field **n** , then it should be faster to name the fields I am searching in, and even faster if I can filter on the keyword field. correct? Because there is one inverted index per field?

Thanks, Andreas

---

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [March 16, 2017, 1:20pm UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692/6 "2017-03-16T13:20:59Z")

</div>

I tested a bit:

result fetches 32k events.  
searching for type: xyz takes about 500ms  
searching for type.keyword: xyz takes about 3s.

why?

Its reproducible. No caching issue.

---

<div class="post-metadata">

### Author: ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [March 16, 2017, 7:20pm UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692/7 "2017-03-16T19:20:47Z")

</div>

Hi Asp

I might need more help from ES team to answer this question for you. Hence I have moved this discussion thread to `ElasticSearch discuss` to get a better answer for the performance comparison.

Thanks  
Rashmi

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 13, 2017, 7:20pm UTC](https://discuss.elastic.co/t/performance-different-if-searching-on-normal-or-keyword-field/78692/8 "2017-04-13T19:20:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
