elasticsearch - Do index names such as "logstash-YYYY.MM.dd" positively affect searches? -


do index names such logstash-yyyy.mm.dd, logstash-yyyy.mm, logstash-yyyy positively affect time-based filtering in kibana? example, having daily indexes avoid kibana querying shards in indexes name falls outside given time filter?

googling has determined multiple shards for:

  1. distributing searches across multiple nodes
  2. planning future addition of nodes achieve 1.

and logstash-style daily/monthly/yearly indexes for:

  1. regularly deleting old documents (since deleting entire index cheaper individually deleting contained documents.)
  2. selectively closing old indexes.

so if don't need able cycle out (delete/close) old documents, or plan have multiple nodes, benefits daily/monthly/yearly indexes have? these indexes (hence shards) go slow down queries?

the important advantage of having indexes in such pattern is:-

  1. you define pattern in kibana & pick indexes saving time put indexes manually.

  2. for querying in ex logstash-yyyy.mm.dd index, query index instead of querying in indexes providing faster response time.


Comments

Popular posts from this blog

javascript - Karma not able to start PhantomJS on Windows - Error: spawn UNKNOWN -

c# - Display ASPX Popup control in RowDeleteing Event (ASPX Gridview) -

Nuget pack csproj using nuspec -