We are getting logs from multiple ips thus a single index can have docs from multiple ips.
I need to categorise set of ips into one group. As of now i am using OR query to filter those group logs.
(ip1 OR ip2 OR .... OR ip26)
Now i am planning to add one extra field to index say group_name, which has information regarding what are all the ips belonging to this group.(ip1 to ip26 --> group1 and ip27 to ip30 -->group2). Now searching method will change as,
I would like to know how much performance gain (index may have 100 million documents) i will get if i migrated to method2 ?