Is Anything wrong in my query .Nest elastic C#

Question

Is there something wrong in my .Nest libs query? My query will get all data, I need to get by multi term. Query string elastic result i want:

{
   "took": 2,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 1000,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "log_query": {
         "doc_count": 2,
         "histogram_Log": {
            "buckets": [
               {
                  "key_as_string": "06/02/2015 12:00:00",
                  "key": 1423180800000,
                  "doc_count": 1
               },
               {
                  "key_as_string": "21/02/2015 12:00:00",
                  "key": 1424476800000,
                  "doc_count": 1
               }
            ]
         }
      }
   }
}

My query string elastic:

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "cluster": "giauht1"
              }
            },
            {
              "term": {
                "server": "hadoop0"
              }
            },
            {
              "term": {
                "type": "Warn"
              }
            },
            {
              "range": {
                "actionTime": {
                  "gte": "2015-02-01",
                  "lte": "2015-02-24"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

My .nest libs query:

 Func<SearchDescriptor<LogInfoIndexView>, SearchDescriptor<LogInfoIndexView>> query =
                que => que.Aggregations(aggs => aggs.Filter("log_query", fil =>
                {
                    fil.Filter(fb => fb.Bool(fm => fm.Must(
                        ftm =>
                        {
                            ftm.Term(t => t.Cluster, cluster);
                            ftm.Term(t => t.Server, server);
                            ftm.Term(t => t.Type, logLevel);
                            ftm.Range(r => r.OnField("actionTime").GreaterOrEquals(from.Value).LowerOrEquals(to.Value));
                            return ftm;
                        }))).Aggregations(faggs => faggs.DateHistogram("histogram_Log", dr =>
                    {
                        dr.Field("actionTime");
                        dr.Interval("1d");
                        dr.Format("dd/MM/YYYY hh:mm:ss");
                        return dr;
                    }));
                    return fil;
                })).Size(0).Type(new LogInfoIndexView().TypeName);
            var result = client.Search(query);

My .nest result:

My model mapping:

{
   "onef-sora": {
      "mappings": {
         "FPT.OneF.Api.Log": {
            "properties": {
               "actionTime": {
                  "type": "date",
                  "format": "dateOptionalTime"
               },
               "application": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "cluster": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "detail": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "iD": {
                  "type": "string"
               },
               "message": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "server": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "source": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "tags": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "type": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "typeLog": {
                  "type": "string"
               },
               "typeName": {
                  "type": "string"
               },
               "url": {
                  "type": "string",
                  "index": "not_analyzed"
               },
               "user": {
                  "type": "string",
                  "index": "not_analyzed"
               }
            }
         }
      }
   }
}

Answer 1

The Must() condition passed to the Bool() filter takes a params Func<FilterDescriptor<T>, FilterContainer>[] but in your filter, the Term() and Range() filters are chained onto the same filter instance; unfortunately, this doesn't work as you might expect and the end result is actually an empty json object passed to the must clause in the query DSL for the filter i.e. you end up with

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {} /* where are the filters?! */
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

The solution is to pass an array of Func<FilterDescriptor<T>, FilterContainer>; The following matches your query DSL

void Main()
{
    var settings = new ConnectionSettings(new Uri("http://localhost:9200"));
    var connection = new InMemoryConnection(settings);
    var client = new ElasticClient(connection: connection);

    DateTime? from = new DateTime(2015, 2,1);
    DateTime? to = new DateTime(2015, 2, 24);

    var docs = client.Search<LogInfoIndexView>(s => s
        .Size(0)
        .Type("type")
        .Aggregations(a => a
            .Filter("log_query", f => f
                .Filter(ff => ff
                    .Bool(b => b
                        .Must(m => m
                            .Term(t => t.Cluster, "giauht1"),
                              m => m
                            .Term(t => t.Server, "hadoop0"),
                              m => m
                            .Term(t => t.Type, "Warn"),
                              m => m
                            .Range(r => r.OnField("actionTime").GreaterOrEquals(from.Value).LowerOrEquals(to.Value))
                        )
                    )
                )
                .Aggregations(aa => aa
                    .DateHistogram("histogram_Log", da => da
                        .Field("actionTime")
                        .Interval("1d")
                        .Format("dd/MM/YYYY hh:mm:ss")
                    )
                )
            )
        )
    );

    Console.WriteLine(Encoding.UTF8.GetString(docs.RequestInformation.Request));
}

public class LogInfoIndexView
{
    public string Cluster { get; set; }
    public string Server { get; set; }
    public string Type { get; set; }
    public DateTime ActionTime { get; set; }    
}

returning

{
  "size": 0,
  "aggs": {
    "log_query": {
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "cluster": "giauht1"
              }
            },
            {
              "term": {
                "server": "hadoop0"
              }
            },
            {
              "term": {
                "type": "Warn"
              }
            },
            {
              "range": {
                "actionTime": {
                  "lte": "2015-02-24T00:00:00.000",
                  "gte": "2015-02-01T00:00:00.000"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "histogram_Log": {
          "date_histogram": {
            "field": "actionTime",
            "interval": "1d",
            "format": "dd/MM/YYYY hh:mm:ss"
          }
        }
      }
    }
  }
}

EDIT:

In answer to your comment, the difference between a filtered query filter and a filter aggregation is that the former applies the filtering to all documents at the start of the query phase and filters are generally cached, improving performance on subsequent queries with those filters, whilst the latter applies in the scope of the aggregation to filter documents in the current context to a single bucket. If your query is only to perform the aggregation and you're likely to run the aggregation with the same filters, I think the filtered query filter should offer better performance.