Why compound queries combine conditions in Elasticsearch - Performance Analysis

Time Complexity: Why compound queries combine conditions

O(n)

Understanding Time Complexity

When we use compound queries in Elasticsearch, we combine multiple conditions to filter data.

We want to understand how the time to run these queries grows as we add more conditions.

Scenario Under Consideration

Analyze the time complexity of the following Elasticsearch compound query.

GET /my_index/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "field1": "value1" } },
        { "range": { "field2": { "gte": 10 } } },
        { "term": { "field3": "value3" } }
      ]
    }
  }
}
    

This query combines three conditions using a boolean "must" clause, meaning all must match.

Identify Repeating Operations

Look at what repeats when Elasticsearch runs this query.

• Primary operation: Each condition filters documents by scanning relevant index parts.
• How many times: The engine processes each condition separately, then combines results.

How Execution Grows With Input

As we add more conditions, Elasticsearch must check more filters for each document.

Input Size (n)	Approx. Operations
10 conditions	About 10 times the work of 1 condition
100 conditions	About 100 times the work of 1 condition
1000 conditions	About 1000 times the work of 1 condition

Pattern observation: The work grows roughly in direct proportion to the number of conditions combined.

Final Time Complexity

Time Complexity: O(n)

This means the time to run the query grows linearly with the number of combined conditions.

Common Mistake

[X] Wrong: "Adding more conditions won't affect query time much because Elasticsearch is fast."

[OK] Correct: Each condition adds work because Elasticsearch must check all conditions, so more conditions mean more time.

Interview Connect

Understanding how combining conditions affects query time helps you design efficient searches and explain your choices clearly.

Self-Check

What if we changed the "must" clause to "should" with a minimum match? How would the time complexity change?

Practice

1. What is the main purpose of using compound queries in Elasticsearch?

easy

A. To combine multiple conditions for more precise search results

B. To speed up the indexing process

C. To delete documents from the index

D. To create new indexes automatically

Solution

1. Step 1: Understand the role of compound queries

   Compound queries allow combining several conditions to refine search results.

2. Step 2: Identify the main benefit

   Combining conditions helps find exactly what you want by mixing rules.

3. Final Answer:

   To combine multiple conditions for more precise search results -> Option A

4. Quick Check:

   Compound queries = combine conditions [OK]

Hint: Compound queries mix conditions to narrow search [OK]

Common Mistakes:

• Thinking compound queries speed up indexing
• Confusing compound queries with index creation
• Believing compound queries delete documents

2. Which of the following is the correct syntax to combine conditions using a bool query in Elasticsearch?

easy

A. {"bool": {"must": [{"match": {"field": "value"}}]}}

B. {"combine": {"and": [{"match": {"field": "value"}}]}}

C. {"query": {"combine": [{"match": {"field": "value"}}]}}

D. {"bool": {"combine": [{"match": {"field": "value"}}]}}

Solution

1. Step 1: Recall the correct bool query syntax

   The bool query uses keys like must, should, must_not, and filter inside a bool object.

2. Step 2: Match the syntax with options

   {"bool": {"must": [{"match": {"field": "value"}}]}} correctly uses "bool" with "must" and a match clause.

3. Final Answer:

   {"bool": {"must": [{"match": {"field": "value"}}]}} -> Option A

4. Quick Check:

   Bool query uses must inside bool [OK]

Hint: Bool query uses must, should, must_not, filter keys [OK]

Common Mistakes:

• Using 'combine' instead of 'bool'
• Placing conditions outside bool
• Wrong nesting of match inside combine

3. Given this Elasticsearch bool query, what documents will it match?

{"bool": {"must": [{"match": {"title": "apple"}}], "must_not": [{"match": {"status": "sold"}}]}}

medium

A. Documents with title 'apple' and status 'sold'

B. Documents with title containing 'apple' and status not 'sold'

C. Documents with title 'apple' or status 'sold'

D. Documents with status 'sold' only

Solution

1. Step 1: Analyze the must clause

   The must clause requires the title field to match 'apple'.

2. Step 2: Analyze the must_not clause

   The must_not clause excludes documents where status matches 'sold'.

3. Final Answer:

   Documents with title containing 'apple' and status not 'sold' -> Option B

4. Quick Check:

   Must + must_not = include and exclude [OK]

Hint: Must means include; must_not means exclude [OK]

Common Mistakes:

• Confusing must_not as must
• Thinking must_not includes documents
• Mixing OR logic instead of AND

4. Identify the error in this Elasticsearch bool query:

{"bool": {"must": {"match": {"name": "john"}}, "should": [{"term": {"age": 30}}]}}

medium

A. "match" is not valid inside "must"

B. "should" cannot be used with "must"

C. "must" should be an array, not a single object

D. The query is correct as is

Solution

1. Step 1: Check the structure of must clause

   The must clause expects an array of conditions, but here it is a single object.

2. Step 2: Verify should clause usage

   The should clause is correctly an array, so no error there.

3. Final Answer:

   "must" should be an array, not a single object -> Option C

4. Quick Check:

   Must requires array of conditions [OK]

Hint: Must and should clauses expect arrays [OK]

Common Mistakes:

• Using object instead of array for must
• Thinking should can't be with must
• Misplacing match inside must

5. You want to find documents where the field "category" is "books" and either "author" is "Alice" or "year" is 2020, but exclude those with "status" as "archived". Which bool query correctly combines these conditions?

hard

A. {"bool": {"should": [{"term": {"category": "books"}}, {"term": {"author": "Alice"}}, {"term": {"year": 2020}}], "must_not": [{"term": {"status": "archived"}}]}}

B. {"bool": {"must": [{"term": {"category": "books"}}, {"term": {"author": "Alice"}}], "must_not": [{"term": {"status": "archived"}}]}}

C. {"bool": {"filter": [{"term": {"category": "books"}}], "must": [{"term": {"author": "Alice"}}, {"term": {"year": 2020}}], "must_not": [{"term": {"status": "archived"}}]}}

D. {"bool": {"must": [{"term": {"category": "books"}}], "should": [{"term": {"author": "Alice"}}, {"term": {"year": 2020}}], "must_not": [{"term": {"status": "archived"}}]}}

Solution

1. Step 1: Identify the required conditions

   Must have category = books, should have author = Alice or year = 2020, and must_not have status = archived.

2. Step 2: Match conditions to bool clauses

   Category is mandatory (must), author or year is optional but at least one (should), and status excluded (must_not).

3. Final Answer:

   {"bool": {"must": [{"term": {"category": "books"}}], "should": [{"term": {"author": "Alice"}}, {"term": {"year": 2020}}], "must_not": [{"term": {"status": "archived"}}]}} -> Option D

4. Quick Check:

   Must + should + must_not combined correctly [OK]

Hint: Must = required, should = optional OR, must_not = exclude [OK]

Common Mistakes:

• Putting author in must instead of should
• Using filter instead of must for category
• Putting all conditions in should