Rolling index with parent/child?

Elastic Stack Elasticsearch
1

Hello everyone,

I was wondering whether there is a possibility to have rolling index (time based) with parent/child relationship.
I am indexing time based data (index per day, all aliased) and all docs are related to one parent with ID. Users than can in any time label each parent and I would need to search (and aggregate) all child docs with certain labels.

Is there any other possibility than Application-side joins ?

Thanks in advance
Jan

2

You can do this, children can refer to a non-existent parent.

3

Parent/child is as you point out very difficult to use with time-based indices due to the limitations that the parent need to be in the same shard as the children, thereby requiring a parent per time-based index in order for filtering on parent fields to work. Depending on the number of children per parent and the frequency at which parent tags change, denormalisation and/or application side joins are generally the best way to go.

4

Hello @Christian_Dahlqvist,

thank you for your answer. The frequency of parent tagging can be hundreds per minute. However I need to apply that tag for ALL docs in the cluster that are related to the parent.

If I understand correctly:
2016-01-01 - I create child C1 with relation to A
2016-01-02 - I create child C2 with relation to A

If user will tag parent A system needs to create/update parent document in both 2016-01-01 and 2016-01-02 indices, is that correct?

Also if next day someone will create new index (2016-01-03) I would be forced to insert parent doc A to this index too...?

Jan

5

If the update frequency is that high I suspect application-side join is the best approach.