Hi, I've read the blog post on Index Vs. Type but I find it hard to understand what's better in my case.
- I have a certain application's log files and a great majority of the log lines mention a few remote IP addresses that my server communicates with on a regular basis
- I also have a second data set from network packet analysis, which includes source/destination IP addresses along with network statistics.
The two data sets are linked by the
destination IP address field.
The second data set (network stats) has much higher data frequency and volume.
- Is the relationship b/w the datasets one that can be called a parent/child relationship?
- Should I be storing those as separate indexes or on the same index, different
- If on the same index, should I use the same field name for both IP addresses fields?
Thanks in advance.