On Friday, May 23, 2014 at 20:13 CEST,
John Smith <[email protected]> wrote:
> #1
> I have been reading around and some people suggest if doing "log"
> analytics to split the index based on time.
> Is this built in into Elastic search or does it mean I have to do it
> manual?
I don't believe Elasticsearch itself understands date-based indices,
but Logstash does.
> If manual
> PUT http://myhost:9200/myindex-(get-current-date-here)/SomeDoc/Id
> I'm pulling my data from SQL server and going to either use ETL or
> JDBC gatherer. I suppose the ETL process needs to consider the date
> and when it does it's index PUT to check and roll over the date so
> that a new index gets created?
Yes.
> And my queries need to consider this also so they know that on each
> day they need to search the new index?
Yes, unless you use an index alias like _all to search in all indices
but that obviously has performance implication and in part voids the
benefits of multiple indices.
> #2 is there such a thing as eviction policies?
> Basically is there a way to check if we are running out of diskspace
> and to either remove entries from the index or in the above case
> delete/archive indexes older then a few days?
If disk space is your limiting factor you should find the curator
script useful. You could also set the _ttl value of messages to have
them automatically expire after a set time.
https://github.com/elasticsearch/curator
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/mapping-ttl-field.html
--
Magnus Bäck | Software Engineer, Development Tools
[email protected] | Sony Mobile Communications
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/20140526063906.GB16396%40seldlx20533.corpusers.net.
For more options, visit https://groups.google.com/d/optout.
