We have been using Elasticsearch for long and have come to a point where we need to do some custom routing. To place the problem in context, in one of the most important index, among many fields in a document, there are 2 fields lets call them eventkind and user. Now as it is many users are associated to a single eventkind and many eventkind to single user. Due to some requirements now we have opposing requirements and faces a issue on how to design the custom reading. If we using eventkind for routing, that will make the user spread out in many shards and hence a query that is based on user is slower and vice-versa. Would like to get some recommendation and thoughts on how one can address this.
logstash_user (Aserdp) #1
warkolm (Mark Walkom) #2
Make a choice for either, or do both by having multiple indices with different views.
system (system) #3