Now I am using elasticsearch as a realtime log analysis. Unfortunately, I
am having performance issue. To resolve this issue, I'd like to try custom
routing with timestamp because our realtime log analysis will be focused on
things such as the last 15 minutes, last 1 hour, or last 4 hours. Is it
possible sharding based on time range? If it's not supported yet, which can
be a good start to implement custom routing logic?
The second question is, currently, as I guess, elasticsearch routing logic
is gathering records with the same routing id in the same shard. If the
data has a skewed distribution on the routing field, does elasticsearch
make balanced shards across the cluster?