Reg multiple Index Types

Elastic Stack Elasticsearch
1

Hi All,

I have some basic questions regarding the Multiple Index Types. Currently
we have a single Index and the Document we are creating are becoming bigger
and bigger.

Ex:

       "Employee" : {
              "type" : "object",
              "properties" : {

                             "id"        : {"type" : "integer",

"store":"yes"},
"name" : {"type" : "string",
"store":"yes", "index":"not_analyzed"}
....
...

                             "auditlog" :{
                                       "id" : {"type" : "integer",

"store":"yes"},
"text" : {"type" : "string",
"store":"yes", "term_vector" : "with_positions_offsets"},
"modification_date" : {"type" :
"date", "store":"yes", "index" : "not_analyzed"},
"modified_by" : {"type" : "integer", "store":"yes", "index" :
"not_analyzed"}
}

              }

       }

Now as we keep adding more and more sub properties for Employee the
document is growing and more over there can be hundreds of entries for
auditlog.

When we perform a search on auditlog property for the match we get the
"Employee" document as search hit and how do we know which auditlog entry
matched the criteria ?? Does the search return the id of the matched
auditlog as well

The solution i can think of is to create an index type for audit logs .
Is this the right approach ? Any comments..

Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Hello,

You could index the audit logs in a different type, and eventually set the
other type as its _parent:

Then you could search in both if you need to. You'll also get more
efficient indexing when you simply want to add a new audit log. Because you
won't need to index the whole document.

On the other hand, if you want to search in audit logs and in the "parent"
docs, that will be slower than with your current mapping. Also, searching
in audit logs will only return audit logs - so if you want the "parent"
information too, you'll have to make an extra fetch.

It's a trade-off, because your other option seems to be to look for the
matching audit log within your application. So I don't know what's right in
your use-case, it depends on how your typical searches look like.

Best regards,
Radu

http://sematext.com/ -- Elasticsearch -- Solr -- Lucene

On Sat, Feb 2, 2013 at 6:18 AM, mars kommineni.sateesh@gmail.com wrote:

Hi All,

I have some basic questions regarding the Multiple Index Types.
Currently we have a single Index and the Document we are creating are
becoming bigger and bigger.

Ex:

       "Employee" : {
              "type" : "object",
              "properties" : {

                             "id"        : {"type" : "integer",

"store":"yes"},
"name" : {"type" : "string",
"store":"yes", "index":"not_analyzed"}
....
...

                             "auditlog" :{
                                       "id" : {"type" : "integer",

"store":"yes"},
"text" : {"type" : "string",
"store":"yes", "term_vector" : "with_positions_offsets"},
"modification_date" : {"type" :
"date", "store":"yes", "index" : "not_analyzed"},
"modified_by" : {"type" : "integer", "store":"yes", "index" :
"not_analyzed"}
}

              }

       }

Now as we keep adding more and more sub properties for Employee the
document is growing and more over there can be hundreds of entries for
auditlog.

When we perform a search on auditlog property for the match we get the
"Employee" document as search hit and how do we know which auditlog entry
matched the criteria ?? Does the search return the id of the matched
auditlog as well

The solution i can think of is to create an index type for audit logs .
Is this the right approach ? Any comments..

Thanks

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.