Issue 1:
The matched_queries item in the response is missing when using a filtered query with nested filter that does not have a must_not clause.

ES version 1.5.2

Steps to reproduce:

Create index and mapping

PUT /test_index

PUT /test_index/doc_type/_mapping
{
"doc_type": {
"dynamic": "strict",
"properties": {
"nestedDoc": {
"type": "nested",
"dynamic": "strict",
"properties": {
"field1": {
"type": "string"
}
}
}
}
}
}

Add a document

PUT /test_index/doc_type/1
{
"nestedDoc": [
{
"field1": "a"
},
{
"field1": "b"
}
]
}

Nested filter query with only a must clause

GET /test_index/doc_type/_search
{
"query" : {
"filtered" : {
"query" : {
"match_all" : { }
},
"filter" : {
"bool" : {
"should" : {
"bool" : {
"must" : {
"nested" : {
"filter" : {
"bool" : {
"must" : {
"term" : {
"field1" : "b"
}
}
}
},
"path" : "nestedDoc"
}
},
"_name" : "QueryName"
}
}
}
}
}
}
}

Returns result - no matched_queries item as expected

{
"took": 1,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 1,
"hits": [
{
"_index": "test_index",
"_type": "doc_type",
"_id": "1",
"_score": 1,
"_source": {
"nestedDoc": [
{
"field1": "a"
},
{
"field1": "b"
}
]
}
}
]
}
}

Nested filter query with an additional must_not clause that does nothing

GET /test_index/doc_type/_search
{
"query" : {
"filtered" : {
"query" : {
"match_all" : { }
},
"filter" : {
"bool" : {
"should" : {
"bool" : {
"must" : {
"nested" : {
"filter" : {
"bool" : {
"must" : {
"term" : {
"field1" : "b"
}
}
}
},
"path" : "nestedDoc"
}
},
"must_not" : {
"exists" : { "field" : "_does_not_exist_" }
},
"_name" : "QueryName"
}
}
}
}
}
}
}

Returns result with expected matched_queries item

{
"took": 1,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 1,
"hits": [
{
"_index": "test_index",
"_type": "doc_type",
"_id": "1",
"_score": 1,
"_source": {
"nestedDoc": [
{
"field1": "a"
},
{
"field1": "b"
}
]
},
"matched_queries": [
"QueryName"
]
}
]
}
}

Issue 2:
Thanks for your response however:

As stated there are only two shards per node (one of them even a replica of another index) and still I get 3(!!!) slowquery logs.

Would there be any other possible reason?

Elasticsearch version: 2.3.4

JVM version: 1.7.0_101

OS version: Ubuntu 14.04

Description of the problem including expected versus actual behavior:

Our setup is as follows:

An index over 11 nodes each of them holding 2 shards one primary and one replica (not of the same shard).

When running a slow query of search_type QUERY_THEN_FETCH and looking at the elasticsearch slow query logs we see that on each of the nodes we are getting 3 calls of the exact same query with timestamps miliseconds apart.

We were wondering whether this is a "feature" of the slow query logging or whether there are really 3 distinct calls of the same query performed on the index and if the latter, what would be an explanation for this.

The query we are running is:

{"index":["index-****************_"],"search_type":"count","ignore_unavailable":true}

{"size":0,"aggs":{"2":{"date_histogram":{"field":"@timestamp","interval":"30m","time_zone":"+03:00","min_doc_count":1,"extended_bounds":{"min":1469318400000,"max":1469393384478}},"aggs":{"3":{"terms":{"field":"level","size":5,"order":{"count":"desc"}}}}}},"query":{"filtered":{"query":{"query_string":{"analyze_wildcard":true,"query":""}},"filter":{"bool":{"must":[{"query":{"match":{"type":{"query":"mainlog","type":"phrase"}}}},{"range":{"@timestamp":{"gte":1469318400000,"lte":1469393384478}}}],"must_not":[]}}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{}},"fragment_size":2147483647}}

And the slow query log (after some processing on our end) is:

[2016-07-28 07:53:00,561][INFO ][index.search.slowlog.query] [index-****************_]took[5.2s], took_millis[5209], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[11], source[{"size":0,"aggs":{"2":{"date_histogram":{"field":"@timestamp","interval":"30m","time_zone":"+03:00","min_doc_count":1,"extended_bounds":{"min":1469318400000,"max":1469393384478}},"aggs":{"3":{"terms":{"field":"level","size":5,"order":{"count":"desc"}}}}}},"query":{"filtered":{"query":{"query_string":{"analyze_wildcard":true,"query":""}},"filter":{"bool":{"must":[{"query":{"match":{"type":{"query":"mainlog","type":"phrase"}}}},{"range":{"@timestamp":{"gte":1469318400000,"lte":1469393384478}}}],"must_not":[]}}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"":{}},"fragment_size":2147483647}}], extra_source[],

(the other two instances are exactly the same with a slight variance on the time taken)