Profiling a more complicated query

To understand how the query trees are displayed inside the Query Profiler, let’s look at a more complicated query.

  1. Index the following data via Console:

    1. POST test/_bulk
    2. {"index":{}}
    3. {"name":"aaron","age":23,"hair":"brown"}
    4. {"index":{}}
    5. {"name":"sue","age":19,"hair":"red"}
    6. {"index":{}}
    7. {"name":"sally","age":19,"hair":"blonde"}
    8. {"index":{}}
    9. {"name":"george","age":19,"hair":"blonde"}
    10. {"index":{}}
    11. {"name":"fred","age":69,"hair":"blonde"}

  2. From the Query Profiler, enter “test” in the Index field to restrict profiled queries to the test index.

  3. Replace the default match_all query in the query editor with a query that has two sub-query components and includes a simple aggregation:

    1. {
    2.    "query": {
    3.       "bool": {
    4.          "should": [
    5.             {
    6.                "match": {
    7.                   "name": "fred"
    8.                }
    9.             },
    10.             {
    11.                "terms": {
    12.                   "name": [
    13.                       "sue",
    14.                       "sally"
    15.                   ]
    16.                }
    17.             }
    18.          ]
    19.       }
    20.    },
    21.    "aggs": {
    22.       "stats": {
    23.          "stats": {
    24.             "field": "price"
    25.          }
    26.       }
    27.    }
    28. }

  4. Click Profile to profile the query and visualize the results.

  5. Select the shard to view the query details.

    Profiling the more complicated query

The detail view contains a row for each query component:

  • The top-level BooleanQuery component corresponds to the bool in the query.
  • The second BooleanQuery corresponds to the terms query, which is internally converted to a Boolean of should clauses. It has two child queries that correspond to “sue” and “sally” from the terms query.
  • The TermQuery that’s labeled with “name:fred” corresponds to match: fred in the query.

If you look at the time columns, you can see that “Self time” and “Total time” are no longer identical on all the rows. Self time represents how long the query component took to execute. Total time is the time a query component and all its children took to execute. Therefore, queries like the Boolean queries often have a larger total time than self time.

Aggregations

This particular query also includes a aggregation (a stats agg on the "age" field). Click Aggregation Profile to view aggregation profiling statistics (this tab is only enabled if the query being profiled contains an aggregation).

Select the name of the shard to view the aggregation details and timing breakdown.

Drilling into the first shard’s details

For more information about how the Query Profiler works, how timings are calculated, and how to interpret various results, see Profiling queries.

Most Popular