Query Performace Help

Elastic Stack Elasticsearch
1

Hi,

We are getting logs from multiple ips thus a single index can have docs from multiple ips.

I need to categorise set of ips into one group. As of now i am using OR query to filter those group logs.

Method1 Example:
(ip1 OR ip2 OR .... OR ip26)

Now i am planning to add one extra field to index say group_name, which has information regarding what are all the ips belonging to this group.(ip1 to ip26 --> group1 and ip27 to ip30 -->group2). Now searching method will change as,

Method2 Example
group_name:group1

I would like to know how much performance gain (index may have 100 million documents) i will get if i migrated to method2 ?

2

Hard to say really as there are so many unknowns, but it should be quicker.
You'd be better off testing.

3

+1 to what Mark said

4

You could also use filtered alias (https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html#filtered) it performs well and can be cached.

5

Adrien/Mark/Thomas Thanks for the suggestions. I will try with test data and report back.

6

Having one more field(group_name) gives 70% speed improvement tested with 10million docs from 13 unique ips.