Skip to content

Conversation

martijnvg
Copy link
Member

@martijnvg martijnvg commented Aug 5, 2025

Evolution of #128334, but is targeted for just loading @timestamp and _tsid field values (tsid is missing and will be added soon) in the context of queries like:

TS metrics-hostmetricsreceiver.otel-default | WHERE `metrics.system.memory.utilization` IS NOT NULL AND @timestamp >= \"2025-07-31T08:58:00.000Z\" AND @timestamp <= \"2025-07-31T10:28:00.000Z\" | STATS AVG(AVG_OVER_TIME(`metrics.system.memory.utilization`)) BY host.name, BUCKET(@timestamp, 1h) | LIMIT 10000

Relates to #128445 and #132379

@martijnvg martijnvg changed the title Push compute value loading down to tsdb codec Push compute engine value loading down to tsdb codec Aug 5, 2025
@martijnvg
Copy link
Member Author

martijnvg commented Aug 6, 2025

I benchmarked this change with the following query:

TS metrics-hostmetricsreceiver.otel-default | STATS COUNT(COUNT_OVER_TIME(`@timestamp`)) BY BUCKET(@timestamp, 1h) | LIMIT 10000

This change only optimizes loading of @timestamp and _tsid fields and the query in the description of pr also loads two other fields (host.name and metrics.system.memory.utilization). Loading these other fields now takes the majority of value source loading and so I'm using the query mentioned here to highlight the impact of this improvement.

Without this change default data partition on my local laptop the average query time after 36 executions is: 957 ms. Detailed profiling of value source operator using shard data partition:

{
    "operator": "ValuesSourceReaderOperator[fields = [@timestamp]]",
    "status": {
        "readers_built": {
            "@timestamp:column_at_a_time:BlockDocValuesReader.SingletonLongs": 59
        },
        "values_loaded": 221184000,
        "process_nanos": 713120339, --> ~713 ms
        "pages_received": 59106,
        "pages_emitted": 59106,
        "rows_received": 221184000,
        "rows_emitted": 221184000
    }
}

{
    "operator": "ValuesSourceReaderOperator[fields = [_tsid]]",
    "status": {
        "readers_built": {
            "_tsid:column_at_a_time:BlockDocValuesReader.SingletonOrdinals": 59
        },
        "values_loaded": 221184000,
        "process_nanos": 941064060, --> ~941 ms
        "pages_received": 59106,
        "pages_emitted": 59106,
        "rows_received": 221184000,
        "rows_emitted": 221184000
    }
}

With this change using default data partition on my local laptop the average query time after 36 executions is: 753 ms. Detailed profiling of value source operator using shard data partition:

{
    "operator": "ValuesSourceReaderOperator[fields = [@timestamp]]",
    "status": {
        "readers_built": {
            "@timestamp:column_at_a_time:TimestampBlockLoader.Timestamps": 59
        },
        "values_loaded": 221184000,
        "process_nanos": 250188096, --> ~250ms
        "pages_received": 59106,
        "pages_emitted": 59106,
        "rows_received": 221184000,
        "rows_emitted": 221184000
    }
}

{
    "operator": "ValuesSourceReaderOperator[fields = [_tsid]]",
    "status": {
        "readers_built": {
            "_tsid:column_at_a_time:TSIDBlockLoader.TSIDs": 59
        },
        "values_loaded": 221184000,
        "process_nanos": 244960319, --> ~245ms
        "pages_received": 59106,
        "pages_emitted": 59106,
        "rows_received": 221184000,
        "rows_emitted": 221184000
    }
}

The detailed profiling output seems to suggest that ~3 times improvement. Note that the profile data was captured with data_partitioning set to shard. Otherwise many more ValuesSourceReaderOperator and then results are not comparable between query executions.

That improvement isn't as visible in the overall query time, because still a big part of time spent is in HashAggregateOperator.

Flame graph with simplified query with this change:
image

martijnvg added a commit to martijnvg/elasticsearch that referenced this pull request Aug 10, 2025
This is the first of many changes that pushes loading of field values to the es819 doc values codec in case of logsdb/tsdb and when the field supports it.

This change first targets reading field values in bulk mode at codec level when doc values type is numeric doc values or sorted doc values, there is only one value per document, and the field is dense (all documents have a value). Multivalued and sparse fields are more complex to support bulk reading for, but it is possible.

With this change, the following field types will support bulk read mode at codec level under the described conditions: long, date, geo_point, point and unsigned_long.

Other number types like integer, short, double, float, scaled_float will be supported in a followup, but would be similar to long based fields, but required an additional conversion step to either an int or float vector.

This change originates from elastic#132460 (which adds bulk reading to `@timestamp`, `_tsid` and dimension fields) and is basically the timestamp support part of it. In another followup, support for single valued, dense sorted (set) doc values will be added for field like _tsid.

Relates to elastic#128445
martijnvg added a commit that referenced this pull request Aug 12, 2025
)

This is the first of many changes that pushes loading of field values to the es819 doc values codec in case of logsdb/tsdb and when the field supports it.

This change first targets reading field values in bulk mode at codec level when doc values type is numeric doc values or sorted doc values, there is only one value per document, and the field is dense (all documents have a value). Multivalued and sparse fields are more complex to support bulk reading for, but it is possible.

With this change, the following field types will support bulk read mode at codec level under the described conditions: long, date, geo_point, point and unsigned_long.

Other number types like integer, short, double, float, scaled_float will be supported in a followup, but would be similar to long based fields, but required an additional conversion step to either an int or float vector.

This change originates from #132460 (which adds bulk reading to `@timestamp`, `_tsid` and dimension fields) and is basically the timestamp support part of it. In another followup, support for single valued, dense sorted (set) doc values will be added for field like _tsid.

Relates to #128445
@martijnvg martijnvg closed this Aug 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants