Problem in Elasticsearch Wildcard filtered Query


(Shakti Gupta) #1

Hi all,

I am trying to write elasticsearch wildcard filtered query for aggregation and below is what I have written. It is working fine but taking so long sometime more than a minute. But if I am searching through kibana results are coming instantly within few seconds. Also CPU load on data node gets higher when running the elastic query but not happening with kibana search.

Elasticsearch query-
{
"query": {
"bool" : {
"must" : [
{ "wildcard" : { "request_url.raw" : "serverstatus*" } }
,{ "range" : { "@timestamp" : { "from" : "now-1800s", "to" : "now-0s" } } }
]
}
},
"aggs" : {
"level" : {
"terms" : {
"field" : "response",
"size" : 300000
}
}
}
}

Kibana Query:
request_url.raw : serverstatus*

Is there a way I can optimize elasticsearch this query like kibana using in background?


(Shakti Gupta) #2

@danielmitterdorfer @fcza @issiaka @Allwyn @forloop @dadoonet @warkolm


(David Pilato) #3

Please read

Specifically the "be patient" part.

Don't ping people like this unless there are already participating in this thread. It breaks the code of conduct IMO.


(Russ Cam) #4

A couple of recommendations:

  1. Move the range query to a bool query filter clause. The query is a predicate so does not require scoring
  2. Instead of asking for 300,000 terms in the aggregation, consider using partitions to return the results over several responses.

If you want exactly the same query as Kibana, then you could also get it in the Request tab


(Shakti Gupta) #5

@dadoonet Pardon me. I tagged few people thinking it would attract their kind attention towards my problem and could help me solving the problem. Also I was not aware of the code of conduct. Anyway thanks for the suggestion.


(Shakti Gupta) #6

Thank you for your help. I think this will solve my problem. I was unaware that it is possible to see the query in kibana background.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.