pattern_text achieves better compression if the index is sorted by the template_id of the largest pattern_text field. Sorting can be done manually with the index.sort.* settings, but if possible we should sort automatically.
Specifically, we should do the following:
- if an index contains a field called
message of type pattern_text:
- if mode=logsdb and there is a host.name field: sort by host.name, message.template_id, timestamp
- else sort by message.template_id, timestamp
Depends on #129062
pattern_text achieves better compression if the index is sorted by the template_id of the largest pattern_text field. Sorting can be done manually with the
index.sort.*settings, but if possible we should sort automatically.Specifically, we should do the following:
messageof typepattern_text:Depends on #129062