As the title stated.
Since the queue size for frozen index is smaller, does it impact search significantly?
We rolled over index that stores events as they come in. The roll over criterion is based on shard size.
We search with wildcard so all the rolled over indices will still be hit.
Has anybody try such configuration?
Can you elaborate more on the wildcard use, an example would be good.
Let's say the indices are xyz-000001, xyz-000002, xyz-000003, etc.
When we search for data, we search for index "xyz*".
So all 3 indices will be searched.
What I am considering is to freeze both 000001 and 000002 since we don't write to them any more. Freezing an index triggered a mode in ES where it uses less RAM according to the document.
I have to specify "ignore_throttled=false" to search for frozen indices.
When I read more into this, I realized that ES is keeping only 1 frozen shard in RAM at a time. So if those frozen indices will be searched frequently, is it still a good trade off?
Basically we use monthly index for lots of events (billions). Each monthly index we utilize rolled over to allow dynamic growth per month. But when we search for data, we need to search the entire month for example.
Each month could see 10+ rollover indices.
Does it make sense to freeze those indices that are no longer being written to but still require frequent/normal searching?
If you are using ILM, then Elasticsearch will only search the indices it needs to,
Well, that doesn't really help me decide on whether to freeze rolled over indices or not.
We often list events happening to a client for the past 4 weeks; therefore, by definition, all indices containing events for such client will be touched.
I would recommend not freezing indices that are heavily searched.
Thanks.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.