Performance Question

Elastic Stack Elasticsearch
1

I want to execute elasticsearch request and I have a doubt what the best way to do that.
The first option is with msearch request, each search with the same filter query but with different aggregation.
The second option is with one search request , and multiple, aggregations.

My question is with option is more faster?

Option 1:

   GET myindex/_msearch
{}
{"size":0,"query":{"bool":{"must":[],"must_not":[{"match":{"field1.keyword":{"query":"aab"}}}]}},"aggs":{"attrBucket":{"terms":{"field":"field1.keyword"}}}}
{}
{"size":0,"query":{"bool":{"must":[],"must_not":[{"match":{"field1.keyword":{"query":"aab"}}}]}},"aggs":{"attrBucket":{"terms":{"field":"field2.keyword"}}}}
{}
{"size":0,"query":{"bool":{"must":[],"must_not":[{"match":{"field1.keyword":{"query":"aab"}}}]}},"aggs":{"attrBucket":{"terms":{"field":"field3.keyword"}}}}

Option 2:

GET myindex/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [],
      "must_not": [
        {
          "match": {
            "field1.keyword": {
              "query": "aab"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "attrBucket1": {
      "terms": {
        "field": "field1.keyword"
      }
    },
    "attrBucket2": {
      "terms": {
        "field": "field2.keyword"
      }
    },
    "attrBucket3": {
      "terms": {
        "field": "field3.keyword"
      }
    }
  }
}
2

It is tricky, the first request will be able to use your cluster more, meaning it might help with latency but hurt throughput. The second request theoretically is better since it only computes the set of matching documents once, but I can't guarantee it will be better in practice.

By default, I'd go with the second option, especially if you expect a high concurrent query load.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.