Skip to content

[8.15] host.id has lower cardinality (#687)#689

Merged
gbanasiak merged 2 commits into8.15from
backport/8.15/pr-687
Oct 29, 2024
Merged

[8.15] host.id has lower cardinality (#687)#689
gbanasiak merged 2 commits into8.15from
backport/8.15/pr-687

Conversation

@github-actions
Copy link

@github-actions github-actions bot commented Oct 2, 2024

Backport

This will backport the following commits from master to 8.15:

Questions ?

Please refer to the Backport tool documentation

host.hostname has cardinality 100 while host.id has cardinality 50.
This happen because in the dataset there is a host.if per each couple
ho hostnames, like a single host.id and for each of them two hostnames
like 'dustin.windows' and 'dustin.linux'. This is probably an artifact
of the data generation script.

Lower cardinality fields might:
* reduce sorting overhead due to less comparisons
* improve compression due to more data clustering together

This change should at least allow us if there is any benefit in choosing
a lower cardinality field.

(cherry picked from commit e2ca95e)
@github-actions github-actions bot added the backport This PR is a backport of some other PR label Oct 2, 2024
@gbanasiak gbanasiak closed this Oct 29, 2024
@gbanasiak gbanasiak reopened this Oct 29, 2024
@gbanasiak
Copy link
Contributor

@elasticmachine update branch

@gbanasiak gbanasiak merged commit 3ffdfd3 into 8.15 Oct 29, 2024
@gbanasiak gbanasiak deleted the backport/8.15/pr-687 branch October 29, 2024 16:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of some other PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Comments