Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to do a join in Elasticsearch -- or at the Lucene level

What's the best way to do the equivalent of an SQL join in Elasticsearch?

I have an SQL setup with two large tables: Persons and Items. A Person can own many items. Both Person and Item rows can change (i.e. be updated). I have to run searches which filter by aspects of both the person and the item.

In Elasticsearch, it looks like you could make Person a nested document of Item, then use has_child.

But: if you then update a Person, I think you'd need to update every Item they own (which could be a lot).

Is that correct? Is there a nice way to solve this query in Elasticsearch?

like image 300
Daniel Winterstein Avatar asked Oct 22 '13 17:10

Daniel Winterstein


People also ask

Can you do joins in Elasticsearch?

Out of the box, Elasticsearch does not have joins as in an SQL database. While there are potential workarounds for establishing relationships in your documents, it is important to be aware of the challenges each of these approaches presents.

What is Lucene version in Elasticsearch?

Lucene or Apache Lucene is an open-source Java library used as a search engine. Elasticsearch is built on top of Lucene. Elasticsearch converts Lucene into a distributed system/search engine for scaling horizontally.

How is Lucene used in Kibana?

To use the Lucene syntax, open the Saved query menu, and then select Language: KQL > Lucene. To search for a range of values, use the bracketed range syntax, [START_VALUE TO END_VALUE] . For example, to find entries that have 4xx status codes, you could enter status:[400 TO 499] .


2 Answers

As already mentioned the way to go is parent/child. The point is that nested documents are extremely performant but in order for them to be updated you need to re-submit the whole structure (parent + nested documents). Although the internal implementation of nested documents consists of separate lucene documents, those nested doc are not visible nor directly accessible. In fact when using nested documents you then need to use proper queries to access them (nested query, nested filter, nested facet etc.).

On the other hand parent/child allows you to have separate documents that refer to each other, which can be updated independently. It has a cost in terms of performance and memory used but it is way more flexible than nested documents.

As mentioned in this article though, the fact that elasticsearch helps you managing relations doesn't mean that you must use those features. In a lot of complex usecases it is just better to have some custom logic on the application layer that handles with relations. In facet there are limitations with parent/child too: for instance you can never get back both parent and children at the same time, as opposed to nested documents that doesn't allow to get back only matching children (for now).

like image 155
javanna Avatar answered Oct 21 '22 13:10

javanna


Take a look at my answer for: In Elasticsearch, can multiple top-level documents share a single nested document?

This discusses the use of _parent mapping as a way to avoid the issue with needing to update every Item when a Person is updated.

like image 39
Phil Avatar answered Oct 21 '22 15:10

Phil