Description
Is your feature request related to a problem? Please describe.
While going through the IpFieldMapper
class and looking through IpFieldMapperType
I noticed that the termQuery, termsQuery, and rangeQuery all use underlying lucene index queries. The documentation also incorrectly points to the fact that IP address do not have doc_values enabled by default. This is incorrect, ref:
Describe the solution you'd like
Wrap all three queries in IndexOrDocValuesQuery
and add checks to ensure that we return the index query if the field is only indexed and doc_values query if we only have doc_values enabled.
Describe alternatives you've considered
Alternative is to leave this as is. But there is potentially a lot of performance improvement to be had. Consider a query that looks like
{
query: {
"range":{
"timestamp: {
"from" :xyz,
"to": xyz
}
},
"terms": {
"ipaddress" :["0.0.0.0", "1.1.1.1"]
}
}
}
We could let the range on the timestamp drive the query and use the doc_values to match the documents for the terms in the ipaddress.
Additional context
#7057
Metadata
Metadata
Assignees
Labels
Type
Projects
Status
Status
Status