Skip to content

elastic-store-four-ways: compact against logsdb and pattern_text on 9.5.5 - #64

Merged
talwgx merged 7 commits into
mainfrom
bench/elastic-store-four-ways
Oct 25, 2026
Merged

talwgx merged 7 commits into
mainfrom
bench/elastic-store-four-ways

Conversation

@talwgx

@talwgx talwgx commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Adds elastic-store-four-ways/: on Elasticsearch 9.5.5 (trial licence), primary store after a force merge to one segment, best_compression on every index, the published OpenTelemetry demo sample (215,039,161 B, 197,430 lines), engine 1.1.150, two repetitions.

The six stores (mean of two repetitions)

Variant Store Of (a)
(a) raw, standard 20,107,900 B 100.0%
(b) logsdb 12,000,374 B 59.7%
(c) logsdb + pattern_text, sorted on message.template_id 6,974,760 B 34.7%
(d) compact, standard 14,905,394 B 74.1%
(e) compact on logsdb 10,720,088 B 53.3%
(f) compact on logsdb, sorted on l1x_tid 8,874,049 B 44.1%

The compact variants include the template dictionary index (537,262 B).

Headline ratios

  • (e) against (c), the comparison METHOD.md fixes: 153.7% of (c), 53.7% more store.
  • (f) against (c), sorted the same way: 127.2% of (c), 27.2% more store.

Logsdb with pattern_text is the smaller store; over (a) and (b) the compact form still saves.

Licence

The default basic licence accepts pattern_text with templating off: the index is created (200), a document indexes (201), and the mapping reads {"type": "pattern_text", "disable_templating": true} with source mode STORED. On the trial the mapping is plain {"type": "pattern_text"}. Recorded in results/licence.json.

Encode and decode

The two encodes are byte-identical (157,228 events, 3,030 templates, 77,422,413 B, 64.0% under the sample before any codec), and the dictionary followed by the events decodes to the sample byte for byte. All 66 checks pass in results/results.md.

Amendment, 2026-10-25

The sort setting alone did not reach Lucene: with index.logsdb.default_sort_on_message_template: true and no host.name in the documents, (c)'s segments carried a sort on @timestamp only (10,649,904 B, 52.9% of (a)), kept in results-setting-only/. (c) sets index.sort.field explicitly, as Elastic's pattern_text page shows, and (f) gives the compact form the same sort on its own template id.

Also adds the folder's rows to the root README tables.

🤖 Generated with Claude Code

talwgx and others added 7 commits October 25, 2026 06:21
Elasticsearch 9.5.5 index store for the OpenTelemetry demo sample four ways: a raw index,
logsdb, logsdb with message as pattern_text (trial licence), and the engine's compact form
(edge-10x 1.1.150, file mode, the published round-trip configs). Force merge to one segment,
_stats/store, two repetitions. Not run yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tern_text decides

compact_logsdb joins the default run. METHOD.md and the README state that the raw index holds
the parsed record (not the 8.17.0 whole-line field), that document counts differ by design
(multi-line folding) and that each index is checked against its own input. The report states
every variant against (a) and (b); compact.json adds the decoded output's sha256.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A new node answers GET /_license with 404 until its self-generated basic licence is in place;
the first run stopped there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… wording in the report

index.sort.field read 'only @timestamp' on the pattern_text index although
default_sort_on_message_template was true; the segments' own sort settles which applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…; compact sorted the same way

The first full run (kept in results-setting-only/) showed the segments of the pattern_text
index sorted on @timestamp only although default_sort_on_message_template was true. (c) now
uses the custom-sorting example from Elastic's pattern_text page, and compact_logsdb_sorted
gives the compact form the same sort on l1x_tid. METHOD.md carries the amendment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Elasticsearch 9.5.5, trial licence, engine 1.1.150, the OpenTelemetry demo sample; primary
store after a force merge to one segment, two repetitions, all 66 checks pass:
raw 20.11 MB, logsdb 12.00 MB, logsdb + pattern_text sorted on its template id 6.97 MB,
compact 14.91 MB, compact on logsdb 10.72 MB, compact on logsdb sorted on l1x_tid 8.87 MB.
Compact on logsdb is 153.7% of logsdb + pattern_text.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@talwgx
talwgx force-pushed the bench/elastic-store-four-ways branch from 26e184b to e35cc62 Compare October 25, 2026 10:22
@talwgx
talwgx merged commit ad1a095 into main Oct 25, 2026
15 checks passed
@talwgx
talwgx deleted the bench/elastic-store-four-ways branch October 25, 2026 10:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant