In an earlier blog post, Log monitoring and unstructured log data, moving beyond tail -f, we talked about collecting and working with unstructured log data. We learned that it’s very easy to add data to the Elastic Stack. So far the only parsing we did was to extract the timestamp from this data, so older data gets backfilled correctly. We also talked about searching this … [Read more...] about The importance of runtime fields and schema on write or read for better analytics
fields
Too many fields! 3 ways to prevent mapping explosion in Elasticsearch
Too many fields! 3 ways to prevent mapping explosion in ElasticsearchEnglish简体中文한국어日本語FrançaisDeutschEspañolPortuguêsA system is said to be "observable" when it has three things: logs, metrics, and traces. While metrics and traces have predictable structures, logs (especially application logs) are usually unstructured data that need to be collected and parsed to be really … [Read more...] about Too many fields! 3 ways to prevent mapping explosion in Elasticsearch