Skip to content

Underlying Elasticsearch queries do not use filter context when appropriate #8367

@peterskim12

Description

@peterskim12

Kibana version: 5.0.0 alpha5

Elasticsearch version: 5.0.0 alpha5

Description of the problem including expected versus actual behavior:
I viewed the Request for a Vertical Bar Chart visualization, expecting the queries for the selected time range in the Dashboard and "drill down" selections to be explicitly defined in the filter context of the Elasticsearch query. However, I noticed they were added to the 'must' clause of the boolean query instead of the filter clause. Unless I'm misunderstanding something, this will result in the "filters" not being cached in the ES filter cache and add latency due to influencing scoring.

e.g. instead of:

"must":[
   {
      "query_string":{
         "query":"*",
         "analyze_wildcard":true
      }
   },
   {
      "match":{
         "geoip.country_name.keyword":{
            "query":"United States",
            "type":"phrase"
         }
      }
   },
   {
      "query_string":{
         "analyze_wildcard":true,
         "query":"*"
      }
   },
   {
      "range":{
         "@timestamp":{
            "gte":1431754102370,
            "lte":1433545147679,
            "format":"epoch_millis"
         }
      }
   }
]

I think it should ideally be generated to:

"must":[
   {
      "query_string":{
         "query":"*",
         "analyze_wildcard":true
      }
   }
],
"filter":[
   {
      "match":{
         "geoip.country_name.keyword":{
            "query":"United States",
            "type":"phrase"
         }
      }
   },
   {
      "range":{
         "@timestamp":{
            "gte":1431754102370,
            "lte":1433545147679,
            "format":"epoch_millis"
         }
      }
   }
]

Steps to reproduce:

  1. Create any visualization using the Terms agg. Save it.
  2. Add viz to a dashboard. Click on one of the term values in viz.
  3. Click up arrow in lower left corner, select Request.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions