|
@@ -20,6 +20,7 @@ So while the cost of storing a millisecond of sensor data from ten years ago is
|
|
|
reading often diminishes with time. It's not useless -- it could easily contribute to a useful analysis -- but it's reduced
|
|
|
value often leads to deletion rather than paying the fixed storage cost.
|
|
|
|
|
|
+[float]
|
|
|
=== Rollup store historical data at reduced granularity
|
|
|
|
|
|
That's where Rollup comes into play. The Rollup functionality summarizes old, high-granularity data into a reduced
|
|
@@ -35,6 +36,7 @@ automates this process of summarizing historical data.
|
|
|
|
|
|
Details about setting up and configuring Rollup are covered in <<rollup-put-job,Create Job API>>
|
|
|
|
|
|
+[float]
|
|
|
=== Rollup uses standard query DSL
|
|
|
|
|
|
The Rollup feature exposes a new search endpoint (`/_rollup_search` vs the standard `/_search`) which knows how to search
|
|
@@ -48,6 +50,7 @@ are covered more in <<rollup-search-limitations, Rollup Search limitations>>.
|
|
|
But if your queries, aggregations and dashboards only use the available functionality, redirecting them to historical
|
|
|
data is trivial.
|
|
|
|
|
|
+[float]
|
|
|
=== Rollup merges "live" and "rolled" data
|
|
|
|
|
|
A useful feature of Rollup is the ability to query both "live", realtime data in addition to historical "rolled" data
|
|
@@ -61,6 +64,7 @@ would only see data older than a month. The RollupSearch endpoint, however, sup
|
|
|
It will take the results from both data sources and merge them together. If there is overlap between the "live" and
|
|
|
"rolled" data, live data is preferred to increase accuracy.
|
|
|
|
|
|
+[float]
|
|
|
=== Rollup is multi-interval aware
|
|
|
|
|
|
Finally, Rollup is capable of intelligently utilizing the best interval available. If you've worked with summarizing
|