Time-series data is time-sensitive information whose records carry timestamps, such as continuously generated web-server logs. In Elasticsearch, this pattern calls for indexing strategies that accommodate periodic rollover rather than treating the data as one indefinitely growing index. section 3.2.3
Apache logs rolling over daily
An Apache web server writes log statements with timestamps to the current day's file. At midnight, the file receives a date stamp and a new file begins. A comparable Elasticsearch design can roll indexes daily, then expose them through one alias instead of requiring searches to name every index individually. section 3.2.3
A practical Elasticsearch pattern for time-series data is:
- Store successive periods in separate indexes as data accumulates. section 3.2.3
- Roll over to a new index periodically, such as hourly, daily, or monthly, when the data requires it. section 3.2.3
- Search through an alias that represents the underlying indexes, avoiding queries that enumerate each index explicitly. section 3.2.3
- Use data streams to hold time-series data across multiple indexes while presenting them as one resource for search and analytics. section 3.2.3
Inspect the Apache log example to connect timestamps and continuous event generation with the need for periodic rollover. section 3.2.3
Inspect how a data stream organizes automatically generated hidden indexes behind a single access point. section 3.2.3
