performance - 索引和查询UUID列表

Question

我们数据中的某些字段将UUID列表作为值。例如:

{
 "name": "pupkin",
 "group": "admins",
 "assets": ["d1f84400-91b6-425c-a11b-9ba7e59930ce",
            "99478356-f6b3-49e2-8cae-f408d5a24492"],
 "action": "login",
 "children": ["2637833e-1017-4d82-bc65-951fffc09c7d",
              "c30f7c34-7a50-4031-bf74-94d413acec15",
              "cffef4ef-df9e-4079-ac2f-50bbe332e223"],
 "level": 20
}

我们对数据的大多数查询都涉及检查一长串UUID(数十个，有时数百个，扩展后可能成千上万个)。列表会不时变化，因此在编写所有列表中的L的所有事件时，都无法针对x预先计算x∈L。

我们当前比较简单的e。 G。使用 _search?search_type=count获取直方图的数据是:

 {"query":
  {"bool":
   {"must": [
    {"query_string": {"query": "user:pupkin AND (assets:d1f84400-91b6-425c-a11b-9ba7e59930ce OR assets:99478356-f6b3-49e2-8cae-f408d5a24492 OR assets:2637833e-1017-4d82-bc65-951fffc09c7d OR assets:c30f7c34-7a50-4031-bf74-94d413acec15)"}},
    {"range": {"time": {"gt": "2014-11-01T00:00:00Z", "lte": "2014-11-01T00:20:00.0001Z"}}},
   ]}},
  "aggs": {"counts": {"date_histogram": {"field": "time", "interval": "minute", "min_doc_count": 0}}}}

但这是无效的:一个60个UUID的列表使查询速度降低了10倍。如何减少这个因素？

Answer 1

我会尝试，而不是query_string，过滤器仅利用过滤器被缓存的能力，从而在后续请求时使它们更快:

{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must": [
            {
              "terms": {
                "assets": [
                  "d1f84400-91b6-425c-a11b-9ba7e59930ce",
                  "99478356-f6b3-49e2-8cae-f408d5a24492",
                  "2637833e-1017-4d82-bc65-951fffc09c7d",
                  "c30f7c34-7a50-4031-bf74-94d413acec15"
                ]
              }
            },
            {
              "range": {
                "time": {
                  "gt": "2014-11-01T00:00:00Z",
                  "lte": "2014-11-01T00:20:00.0001Z"
                }
              }
            }
          ]
        }
      }
    }
  },
  "aggs": {
    "counts": {
      "date_histogram": {
        "field": "time",
        "interval": "minute",
        "min_doc_count": 0
      }
    }
  }
}