elasticsearch - Replacing OR/AND/NOT filters with bool filter creates a hard-to-understand query with too many levels? -
i have following filter in filtered query. seen, has many or/and/not filters @ different levels. advised replace them bool filters performance reasons, , going that.
"filter" : { "or" : [ { "and" : [ { "range" : { "start" : { "lte": 201407292300 } } }, { "range" : { "end" : { "gte": 201407292300 } } }, { "term" : { "condtion1" : false } }, { "or" : [ { "and" : [ { "term" : { "condtion2" : false } }, { "or": [ { "and" : [ { "missing" : { "field" : "condtion6" } }, { "missing" : { "field" : "condtion7" } } ] }, { "term" : { "condtion6" : "nop" } } { "term" : { "condtion7" : "rst" } } ] } ] }, { "and" : [ { "term" : { "condtion2" : true } }, { "or": [ { "and" : [ { "missing" : { "field" : "condtion3" } }, { "missing" : { "field" : "condtion4" } }, { "missing" : { "field" : "condtion5" } }, { "missing" : { "field" : "condtion6" } }, { "missing" : { "field" : "condtion7" } } ] }, { "term" : { "condtion3" : "abc" } }, { "term" : { "condtion4" : "def" } }, { "term" : { "condtion5" : "ghj" } }, { "term" : { "condtion6" : "nop" } }, { "term" : { "condtion7" : "rst" } } ] } ] } ] } ] }, { "and" : [ { "term": { "condtion8" : "time_point_1" } }, { "range" : { "start" : { "lte": 201407302300 } } }, { "or": [ { "term" : { "condtion9" : "group_b" } }, { "and" : [ { "term" : { "condtion9" : "group_a" } }, { "ids" : { values: [100, 10] } } ] } ] } ] }, { "and" : [ { "term": { "condtion8" : "time_point_2" } }, { "ids" : { values: [100, 10] } } ] }, { "and" : [ { "term": { "condtion8" : "time_point_3" } }, { "or": [ { "term" : { "condtion1" : true } }, { "range" : { "end" : { "lt": 201407302300 } } } ] }, { "or": [ { "term" : { "condtion9" : "group_b" } }, { "and" : [ { "term" : { "condtion9" : "group_a" } }, { "ids" : { values: [100, 10] } } ] } ] } ] } ] } however, feel replacing these or/and/not filters create query has many levels , hard understand. example, replacing
"or": [ .... ] i have have:
"bool" { "should": [ ] } am right replacing or/and/not bool filter in case @ expense of sacrificing understandability?
a related question
if have replace or/and/not filters performance, should replace all of these or/and/not filters, or of them such 1 @ top example?
thanks , regards.
you should replace of them except geo/script/range filters. having said understanding possible impact of each filter can also. example if 1 of filter going filter out 90% of result may want put in , filter @ starting. since and/or filters executed sequentially rest of filters have lesser documents process. in case of bool filters filters combined in single bitset operation. might have read it.
i don't think sacrificing understability replacing or/and/not bool filter. example have given, single or filter converting should filter looks increase in query structure in overall combination structure similar.
