949050 - Supersearch: allow faceting on multiple fields simultaneously

Status: RESOLVED FIXED

(Socorro :: Webapp, task, P3)

Description

[Benjamin Smedberg]

Right now in supersearch you can choose to facet on individual fields (even more than one individual field), but you cannot facet on multiple fields at the same time. I'd like to be able to do things like facet on buildid+signature or other combinations like that.

Really, being able to put multiple separate fields in the facet list is not as interesting to me, so I'd be fine with removing that from the UI if that makes it easier to do this version of multi-faceting.

Comment 1

[Benjamin Smedberg]

This is not possible with elasticsearch "facet" but it is possible with ES "aggregations". 

See http://stackoverflow.com/questions/14181674/multiple-group-by-in-elasticsearch and http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-aggregations.html and http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html

I tried to run the following query as a prototype, but I'm hitting "oops, an error occurred". Adrian can you check the logs for me, or pass through more detailed errors messages on search/custom?

{
    "filter": {
        "and": [
            {
                "range": {
                    "processed_crash.date_processed": {
                        "gte": "2014-05-07T12:51:04+00:00"
                    }
                }
            },
            {
                "range": {
                    "processed_crash.date_processed": {
                        "lte": "2014-05-14T12:51:04+00:00"
                    }
                }
            },
            {
                "term": {
                    "processed_crash.signature.full": "js::jit::BaselineScript::nativeCodeForPC(JSScript*, unsigned char*, js::jit::PCMappingSlotInfo*)"
                }
            }
        ]
    },
    "aggregations": {
        "channel": {
           "terms": {
                "field": "processed_crash.release_channel"
           },
           "aggregations": {
               "build": {
                   "terms": {
                       "field": "processed_crash.build"
                   }
               }
           }
        }
    },
    "size": 0
}

Comment 2

[[DEACTIVATED] Adrian Gaudebert]

We are currently running elasticsearch 0.90, and aggregations are a new feature of ES 1.x. We will need to upgrade before you can use that feature. See bug 1010239.

Comment 3

[[DEACTIVATED] Adrian Gaudebert]

This works with the API, but won't be available in the UI unless really really needed. Hopefully that's enough.

Comment 4

[Benjamin Smedberg]

That's not great. The set of people who can hand-construct API queries is almost nil, and this isn't discoverable. What would it take to build the API for this?

Comment 5

[[DEACTIVATED] Adrian Gaudebert]

Considering that we are moving the data to Telemetry (tracker: bug 1273657), would it be doable with tools like spark and redash? I think it will be a waste of effort to add that feature to Super Search if we can do it in a few month in Telemetry.

Comment 6

[Benjamin Smedberg]

Is the supersearch webpage going to continue to exist after the spark/redash transition? I don't really understand your project plan, but since ES already supports multi-faceting and it's very valuable for crash analysis, I feel like if we're going to keep supersearch at all, it should support this. We really don't need new UI: we just need to change the behavior of the existing UI to multi-facet instead of facet independently.