Why and how to search two years back in your Elastic search logs [pdf]
cloudvyzor.com
cloudvyzor.com
A number of years ago we had your typical low-disk-space-server problem and someone had bought us time by shortening the log rotation interval and compressing the logs. This is how I (re-)discovered zless and zgrep.
Streaming compression dovetails nicely with a number of kinds of tools, but seems to work particularly well on anything with pipe semantics. I'm certain that phenomenon informed the rather long tenure of the tgz file format.
Compressing text and searching text are both about identifying patterns. How much R&D have we done on trying to do both at the same time? Is searching for text in a compressed file in log(n) to sqrt(n) time a solved problem?
(Submitted title was "Convert: Elastic Search snapshots to zipped JSONs. 60TB to 3TB searchable [pdf]")