Hi all,
I'm collecting information with filebeat, procesing it with logstash and storing in elasticsearch. I have different types and sub-types of information, and indexing the information with something similar to
%{[type]}-%{sub_type}-%{+YYYY.MM.dd}
For the same "type" i have several "sub_type".
Then we have one dashboard with several charts and tables getting data from those indexes.
The question is regarding performance, what is the best option:
- having one index pattern type* and then in the charts adding filters for sub_type.keyword:XX for the different sub_type
or
- having one index pattern for each sub_type: type-sub_type* and in this case not using the filter
thanks