Skip to content

Sort by pattern_text field if exists #135031

@parkertimmins

Description

@parkertimmins

pattern_text achieves better compression if the index is sorted by the template_id of the largest pattern_text field. Sorting can be done manually with the index.sort.* settings, but if possible we should sort automatically.

Specifically, we should do the following:

  • if an index contains a field called message of type pattern_text:
    • if mode=logsdb and there is a host.name field: sort by host.name, message.template_id, timestamp
    • else sort by message.template_id, timestamp

Depends on #129062

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions