Why use multiple indexes?
You may have multiple reasons, and may use multiple indexes for a given application in an Elasticsearch cluster. One of the most popular facts is that deleting indexes is very effective (and deleting many documents is not efficient). This is useful if your application frequently adds and deletes data. For example, if your application has kept data " hot " in Elasticsearch for the last 100 days , you can divide the data into an index every week. This method is very effective, you can search in about 15 indexes to query all 100 days, which is a moderate compromise.
Another example is a multi-tenant application (for example, an application like Gmail ), where each user's data is stored in a single index. This allows you to scale each index independently.
In cases where multiple indexes need to be queried, Elasticsearch simplifies this operation by allowing you to specify the " scope " of the search to include multiple indexes (a comma-separated list, based on regular expressions or other convenient options). The same
Assuming a plan uses an index every week, here are some examples to search for documents with the "dremio" tag:
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# search a specific index curl -XGET 'localhost:9200/2017-week47/_search?q=tag:dremio'
# search specific year curl -XGET 'localhost:9200/2017-*/_search?q=tag:dremio'
# search a specific week across all years (eg, holidays) curl -XGET 'localhost:9200/*-week51/_search?q=tag:dremio'
# search across all weeks curl -XGET 'localhost:9200/_all/_search?q=tag:dremio'
# search across all weeks, except Christmas week curl -XGET 'localhost:9200/+_all,-*week51/_search?q=tag:dremio'
# In case you are using types, the same idea applies to types:
# search across users and orders, for all weeks, except Christmas week curl -XGET 'localhost:9200/+_all,-*week51/users,orders/_search?q=tag:dremio' |