不爲也 比不能也

This is the first post in a three-part series about Instant Aggregations. See how the story progresses in The Great Query Refactoring: Thou Shalt Only Parse Once and wraps up in Instant Aggregations: Rewriting Queries for Fun and Profit. Enjoy the trilogy! 이 게시물은 Instant Aggregation에 대한 시리즈 중 첫번째 게시물입니다. The Great Query Refactoring: Thou Shalt Only Parse Once에서 어떻게 진행되는지 확인하고 Instant Aggregation..

Text vs. keywordWith the release of Elasticsearch 5.0 coming closer, it is time to introduce one of the release highlights of this upcoming release: the removal of the string type. The background for this change is that we think the string type is confusing: Elasticsearch has two very different ways to search strings. You can either search whole values, that we often refer to as keyword search, ..

Lucene 6.0 introduced new exciting feature called multi-dimensional points. While the name of the feature puts a lot of emphasis on the fact that it supports multiple dimensions, this feature behaves more than decently in the case of a single dimension and actually better than the trie encoding that was used in previous versions of Lucene. This caused us to refactor number-based fields (byte, sh..

Anybody who uses Elasticsearch for indexing time-based data such as log events is accustomed to the index-per-day pattern: use an index name derived from the timestamp of the logging event rounded to the nearest day, and new indices pop into existence as soon as they are required. The definition of the new index can be controlled ahead of time using index templates.log event처럼 시간 기반의 data를 index..

With 5.0 on the horizon, a number of query types deprecated in 2.x will be removed. Many of those are replaced by functionality of the bool query, so here’s a quick guide on how to move away from filtered queries; and, or, not queries; and a general look into how to parse boolean logic with the bool query.5.0 이 출시되면서, 2.x 에서 deprecate된 많은 query 유형이 제거된다. 그들 중 많은 부분이 bool query 기능으로 대체된다. 그래서, 여기..

Engineers can resist anything except giving their processes more resources: bigger, better, faster, more of cycles, cores, RAM, disks and interconnects! When these resources are not a bottleneck, this is wasteful but harmless. For processes like Elasticsearch that run on the JVM, the luring temptation is to turn the heap up; what harm could possibly come from having more heap? Alas, the story is..

_reindex and _update_by_query are coming to Elasticsearch 2.3.0 and 5.0.0-alpha1! Hurray!_reindex 와 _update_by_query 가 Elasticsearch 2.3.0 과 5.0.0 에 제공된다._reindex reads documents from one index and writes them to another index. It can be used to copy documents from one index to another, enrich documents with fields, or recreate the index to change settings that are locked when the index is creat..

I remember a couple years ago I was at a convention talking to folks about Elasticsearch or Lucene and one of them said something like "Everyone knows that if you really want to search fast you need to just use term queries." He was certainly right about term queries being fast but I really wanted to run some numbers and see just how right he was. And that felt like a good time to write a blog p..

As the project manager of stagemonitor, an open source performance monitoring tool, I've recently been looking for a database to replace the cool-but-aging Graphite Time Series DataBase (TSDB) as the backend. TSDBs are specialised packages for storing (performance) metric data, like the response time of your app or the CPU utilisation of a server. Ultimately, we were looking for a datastore that..

A little over a year ago I described how to maximize indexing throughput with Elasticsearch, but a lot has changed since then so here I explain the changes that affect indexing performance in Elasticsearch 2.0.0.약 1년전, Elasticsearch에서 처리량을 최대화하는 방법에 대해 설명한 적이 있다. 그런데, 그때에 비해 많은 것이 변경되어, 여기에서 Elasticsearch 2.0.0 에서 index 성능에 영향을 미치는 변경 사항에 대해 설명한다.Store throttling is now automaticPrior to 2.0.0, ..