Best way to tag a large amount of documents

Elastic Stack Elasticsearch
1

Hi all,

This is my first question topic :slight_smile:

Me and my colleagues are trying to figure out the best way to manage tags on a bunch of documents.
Our scenario is, many several devices that send data to elastic, the users could set different tags on the device through a web application in order to organize the work.

We would avoid to update hundred of thousand of documents every time a user adds or removes a tag, we are thinking to create a single parent document (per device) which contains the variables data, like tags, and links it to device's documents with a "join" field datatype during the indexing process.

This would allow to update a single document per device every time that a change happen.

Could be a good solution? Any suggestion or tip would be great!

Thanks

2

Updating some thousand of documents might be worth doing as using the join datatype has some drawbacks like memory usage.

So if the maximum update time is still reasonable, I'd go to the update way. Otherwise I'd use the join datatype.

3

Thank for the reply,

after some research i found another possible drawback of join, the parent and child must belong to the same shard so if i rollover my index with an ilm policy I'll have to create again the parent document, right?

4

I never thought about this but I believe you're right.