ES design regarding duplicates across indexes

[warkolm (Mark Walkom)]

Using time based is best.

@seanwang30

The problem is that if a service exists across the hours, say index1 and index2 and we ask for 2 hours of data, the query would return duplicates coming from both indices.

Can you elaborate more on your document structure? If this is time based data then usually you'd have an event at $time, and then event at $time+n and they would both have different values. Is that not the case?

@seanwang30

My setup looks like this: 2 master nodes

That's bad, see Important Configuration Changes | Elasticsearch: The Definitive Guide [2.x] | Elastic