Describe the suggested improvement
Is your improvement related to a problem? Please describe.
The Query search field of both MessagesViewIndex and MessagesViewIndexWithFullTextSearch indexes every metadata value and every header value. A large share of those are timestamps, durations, sizes, booleans, and identifiers. It's very unlikely that anyone searches for a timestamp or a ProcessingTime. Because each of those values is unique per message, they never share dictionary terms across documents, so they inflate the term dictionary far more than the shared tokens (endpoint names, message types, host names) do.
Describe the suggested solution
As proposed by this spike, many details are removed from the indexes to reduce their performance impact.
Additional Context
NA
Describe the suggested improvement
Is your improvement related to a problem? Please describe.
The
Querysearch field of bothMessagesViewIndexandMessagesViewIndexWithFullTextSearchindexes every metadata value and every header value. A large share of those are timestamps, durations, sizes, booleans, and identifiers. It's very unlikely that anyone searches for a timestamp or aProcessingTime. Because each of those values is unique per message, they never share dictionary terms across documents, so they inflate the term dictionary far more than the shared tokens (endpoint names, message types, host names) do.Describe the suggested solution
As proposed by this spike, many details are removed from the indexes to reduce their performance impact.
Additional Context
NA