Subtracting term X from log a from term Y from log b?

Elastic Stack Elasticsearch
1

Hi after watching this video, made by @Mark_Harwood.
I understood that for every period of time I have to send the logs regarding a certain entity to a new index. for example for every message, I have 6 logs and I need to subtract a term from the 6th log with the 1st log, I will have to send all 6 logs to a new index.

doesn't this create too many indexes?

2

You only need one index for entities. You patch it with updates from your event index

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.