Hi All,
We know there are two types mechanism to create multiple indices, if the size of data is too large for one index. Namely, 1) time-based: where time is used in the suffix-of the index name, e.g. MyIndex-2019, MyIndex-2020, etc. & 2) rollover-indices: which is the new approach as discussed here
My question is, which is faster given we know the Time-Range in which the user wants to search ? For example, if I know the user wants to search data in 2019, in time-based index I would direct the query to MyIndex-2019, but in rollover-index I am forced to query all indices even if I know the time.
Ofcourse it is understandable, that the first query is slow for the rollover-index, but will the sebsequent queries also be slow ? Do you have any benchmark comparing performace of time-based and rollover indices.
Thanks for your time and support.