Hi,
I am getting very different performance for the following two queries
Query1: using QueryStringQuery
{
"query": {
"query_string": {
"query": "*abc* *def* ",
"fields": [
"field1",
"field2"
],
"default_operator": "and",
"allow_leading_wildcard": true,
"lowercase_expanded_terms": false,
"analyze_wildcard": true
}
}
}
Query2: Using bools:
{
"query": {
"bool": {
"must": [
{
"bool": {
"should": [
{
"wildcard": {
"field1": "*abc*"
}
},
{
"wildcard": {
"field3": "*abc*"
}
}
]
}
},
{
"bool": {
"should": [
{
"wildcard": {
"field1": "*def*"
}
},
{
"wildcard": {
"field3": "*def*"
}
}
]
}
}
]
}
}
}
Their explain plans (via /events/mylog/_validate/query?explain are similar:
Query1 (query string query):
"explanation": "filtered(+(field1:*abc* | field2:*abc*) +(field1:*def* | field2:*def*))->cache(_type:mylog)"
Query2 (boolean):
"explanation": "filtered(+(field1:*abc* field3:*abc*) +(field1:*def* field3:*def*))->cache(_type:systemlog)"
The only difference is the '|' in the first query plan. Does anyone know what that stands for? And why I might be seeing the different performance?