Download logFaces User Manual

Copyright ©2009-2015 Moonlit Software Ltd, All rights reserved
When doing queries from partitioned store, logFaces server may hit more than one partition,
depending on the time range user asks for. For example if query spans 3 days and your partitions
are sized by 1 day, there will be 3 database hits on the server side. It may sound that things will go
three times slower but this is not true. When dealing with billions of log events, it's much faster to hit
few smaller collections few times than to hit one big collection once. But you still should consider the
partition size, if going after several days of data is something you will be doing very often – consider
to span partitions for several days. Keep in mind that once the store is partitioned, it can not be
modified.
Once you switch to partitioned storage type, next thing you want to do is to adjust the retention –
number of days to keep your logs for:
One last thing is indexes. They need need special mentioning. Each partition contains one collection
named 'log' where actual data is stored for the given time range. When server allocates new
partitions, it will automatically build indexes for the new partition but it takes indexes
information from its previous partition. So, make sure to select and define your indexes for the
current day as soon as you create partitioned store as it will start rolling day after day and doesn't
require your attention.
Note that names of databases in MongoDB instance (logFaces partitions) follow strict format, avoid
changing them or dropping them manually, this may confuse the server. If you list databases in
MongoDB node you will find logFaces partitions named like lfsp-020414-030414 where numbers
denote the start and the end of the partition date, in this case the partition spans from Apr 2 until the
end of Apr 3 of year 2014.
62