WARNING: Version 2.3 of Elasticsearch has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
A more complex exampleedit
To demonstrate a slightly more complex query and the associated results, we can profile the following query:
GET /test/_search
{
"profile": true,
"query": {
"term": {
"message": {
"value": "search"
}
}
},
"aggs": {
"non_global_term": {
"terms": {
"field": "agg"
},
"aggs": {
"second_term": {
"terms": {
"field": "sub_agg"
}
}
}
},
"another_agg": {
"cardinality": {
"field": "aggB"
}
},
"global_agg": {
"global": {},
"aggs": {
"my_agg2": {
"terms": {
"field": "globalAgg"
}
}
}
}
},
"post_filter": {
"term": {
"my_field": "foo"
}
}
}
This example has:
- A query
- A scoped aggregation
- A global aggregation
- A post_filter
And the response:
{
"profile": {
"shards": [
{
"id": "[P6-vulHtQRWuD4YnubWb7A][test][0]",
"searches": [
{
"query": [
{
"query_type": "TermQuery",
"lucene": "my_field:foo",
"time": "0.4094560000ms",
"breakdown": {
"score": 0,
"next_doc": 0,
"match": 0,
"create_weight": 31584,
"build_scorer": 377872,
"advance": 0
}
},
{
"query_type": "TermQuery",
"lucene": "message:search",
"time": "0.3037020000ms",
"breakdown": {
"score": 0,
"next_doc": 5936,
"match": 0,
"create_weight": 185215,
"build_scorer": 112551,
"advance": 0
}
}
],
"rewrite_time": 7208,
"collector": [
{
"name": "MultiCollector",
"reason": "search_multi",
"time": "1.378943000ms",
"children": [
{
"name": "FilteredCollector",
"reason": "search_post_filter",
"time": "0.4036590000ms",
"children": [
{
"name": "SimpleTopScoreDocCollector",
"reason": "search_top_hits",
"time": "0.006391000000ms"
}
]
},
{
"name": "BucketCollector: [[non_global_term, another_agg]]",
"reason": "aggregation",
"time": "0.9546020000ms"
}
]
}
]
},
{
"query": [
{
"query_type": "MatchAllDocsQuery",
"lucene": "*:*",
"time": "0.04829300000ms",
"breakdown": {
"score": 0,
"next_doc": 3672,
"match": 0,
"create_weight": 6311,
"build_scorer": 38310,
"advance": 0
}
}
],
"rewrite_time": 1067,
"collector": [
{
"name": "GlobalAggregator: [global_agg]",
"reason": "aggregation_global",
"time": "0.1226310000ms"
}
]
}
]
}
]
}
}
As you can see, the output is significantly verbose from before. All the major portions of the query are represented:
-
The first
TermQuery(message:search) represents the maintermquery -
The second
TermQuery(my_field:foo) represents thepost_filterquery -
There is a
MatchAllDocsQuery(*:*) query which is being executed as a second, distinct search. This was not part of the query specified by the user, but is auto-generated by the global aggregation to provide a global query scope
The Collector tree is fairly straightforward, showing how a single MultiCollector wraps a FilteredCollector to execute the post_filter (and in turn wraps the normal scoring SimpleCollector), a BucketCollector to run all scoped aggregations. In the MatchAll search, there is a single GlobalAggregator to run the global aggregation.