Query speed advice

Elastic Stack Elasticsearch
1

Hello,

I have two queries that produce results basically in the same amount of time and I think there was more discrepancy in the 1.7 version versus the 2.0. I know filters and queries have been reworked so I was hoping I could get advice as to which one is more "efficient" or neither.

-- option 1

POST /siptrace-*/_search
{
   "sort": [
      {
         "line": "asc"
      }
   ],
   "from": "0",
   "size": "1000",
   "query": {
      "filtered": {
         "query": {
            "bool": {
               "must": [
                  {
                     "match": {
                        "callid": "201369922_133976002@192.168.18.110"
                     }
                  }
               ]
            }
         }
      }
   }
}

-- option 2

POST /siptrace-*/_search
{
   "sort": [
      {
         "line": "asc"
      }
   ],
   "from": "0",
   "size": "1000",
   "query": {
      "filtered": {
         "query": {
            "term": {
               "callid": "201369922_133976002@192.168.18.110"
            }
         }
      }
   }
}

Thanks in advance!

2

Filtered queries are deprecated so you should use a bool query with a filter clause IMO.

3

So like this you mean?

POST /siptrace-*/_search
{
   "sort": [
      {
         "line": "asc"
      }
   ],
   "from": "0",
   "size": "1000",
   "query": {
      "bool": {
         "filter": [
            {
               "term": {
                  "callid": {
                     "value": "201369922_133976002@192.168.18.110"
                  }
               }
            }
         ]
      }
   }
}
4

Exactly!

5

If possible I would reduce size parameter though but it's not related to your question.

6

yeah sounds good. I just used that size for testing haha.

Thanks!