Search Query Categorization (Phase 1)

[deshsidd]

Is your feature request related to a problem? Please describe.
Today OpenSearch customers have limited very visibility into the query workload running on a cluster. There is also no easy way to identify patterns in the queries being executed upon an index. This imposes a huge gap while debugging performance issues, tracking changes in data access patterns, or when targeting new feature improvements.

The Query Classification feature in OpenSearch aims to enhance the platform's capabilities by providing a mechanism to identify patterns, latencies and resource utilization breakdown for the queries being executed upon an index. This will empower users and administrators to optimize query performance and identify query types for better resource allocation and index management.

The primary objective of this proposal is to implement a query classification mechanism within OpenSearch that can categorize and analyze the queries being executed on an index.

Describe the solution you'd like
Instrument the Query Builder logic in OpenSearch to recognize and categorize queries based on their patterns, such as search queries, aggregation queries, filtering queries, etc. This will provide insights into the types and frequencies of queries being executed on the index.

Use metric counters to record this information using Metric Framework : #10241

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Example query classification information:
total_queries
total_nested_queries
total_aggs
total_nested_aggs
match
multi_match
bool
nested_bool
wildcard
regexp
match_phrase_prefix
query_string
term
range
function_score

[dblock]

How useful is such a classification? How will it be used?

I do think it would be really useful to separate query shape from query data on the other hand and classify queries by their shapes, then be able to roll up the most expensive queries, but it sounds like that may not be covered by this proposal.

[msfroh]

I do think it would be really useful to separate query shape from query data on the other hand and classify queries by their shapes, then be able to roll up the most expensive queries, but it sounds like that may not be covered by this proposal.

I agree with @dblock -- I would like to be able to capture the full shape of all queries (along with the shape of any aggregations).

Using the new QueryBuilderVisitor API added by @vibrantvarun, I think we can capture query shape pretty easily. I cobbled together a quick and dirty visitor that outputs JSON: https://gist.github.com/msfroh/74aa3fee52f4074c5e7b8d85f76e88ab