I have a use case. That I have a time-based log store in ES. There are two plans to store it.
[Store in one index] Plan A
I will only create one index to store the log.
[Store in daily index and use alias] Plan B
Daily create a new index to store the time-based log. And setup alias to include all the daily indices.
In terms of query, in Plan B I will need to query an alias which has 365 indices behind for a year. For plan A I only need to query in one index.
Can I know when I query an alias, what is the strategy of an alias to send the request to different indices?
In terms of querying from PLAN A and PLAN B for 1 year data, which one is faster?