elasticsearch - Do index names such as "logstash-YYYY.MM.dd" positively affect searches? -
do index names such logstash-yyyy.mm.dd
, logstash-yyyy.mm
, logstash-yyyy
positively affect time-based filtering in kibana? example, having daily indexes avoid kibana querying shards in indexes name falls outside given time filter?
googling has determined multiple shards for:
- distributing searches across multiple nodes
- planning future addition of nodes achieve 1.
and logstash-style daily/monthly/yearly indexes for:
- regularly deleting old documents (since deleting entire index cheaper individually deleting contained documents.)
- selectively closing old indexes.
so if don't need able cycle out (delete/close) old documents, or plan have multiple nodes, benefits daily/monthly/yearly indexes have? these indexes (hence shards) go slow down queries?
the important advantage of having indexes in such pattern is:-
you define pattern in kibana & pick indexes saving time put indexes manually.
for querying in ex logstash-yyyy.mm.dd index, query index instead of querying in indexes providing faster response time.
Comments
Post a Comment