Search performance: IndicesQuery (deprecated) vs. query on field _index

[Jul]

Hey there,

I want to search across multiple indices with different fields on each index. The deprecated IndicesQuery (https://www.elastic.co/guide/en/elasticsearch/reference/5.5/query-dsl-indices-query.html) performs really well (around 10msec). However, if I replace the query with a bool filter on the _index field (as suggestest) search performance drops significantly.

My query runs against an index alias with around 80 indices, the indices only have a few fields in common. (where is no such significant performance drop if only a few indices are queried.)

I'm not sure if my second query is correct or if this is just the "new" behaviour. It might be possible if I understand the discussion correctly: https://github.com/elastic/elasticsearch/issues/23306

Here are the two queries and the validation/ explain output, maybe someone can have a look and tell me if the second query is correct:

{
  "query" : {
    "bool" : {
      "should" : [
        {
          "indices" : {
            "indices" : [
              "index_0"
            ],
            "query" : {
              "query_string" : {
                "query" : "test",
                "fields" : [
                  "field_1",
                  "field_2"
                ]
              }
            },
            "no_match_query" : {
              "match_none" : {
                "boost" : 1.0
              }
            }
          }
        }
      ]
    }
  }
}

_validate?explain

   {
      "index": "index_0",
      "valid": true,
      "explanation": "(field_1:test | field_2:test)"
    },
    {
      "index": "index_1",
      "valid": true,
      "explanation": """MatchNoDocsQuery("User requested "match_none" query.")"""
    }

Query on field _index:

{
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "filter": [
              {
                "match": {
                  "_index": "index_0"
                }
              },
              {
                "bool": {
                  "must": [
                    {
                      "query_string": {
                        "query": "test",
                        "fields": [
                          "field_1",
                          "field_2"
                        ]
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      ]
    }
  }
}

_validate?explain

    {
          "index": "index_0",
          "valid": true,
          "explanation": "+(#*:* #(+(field_1:test | field_2:test)))"
        },
        {
          "index": "index_1",
          "valid": true,
          "explanation": """+(#MatchNoDocsQuery("Index didn't match. Index queried: index_1 vs. [65 6c 6f 31 31 30 5f 32 32]") #(+(field_1:test | field_2:test)))"""
        }

Thanks,
Jul