Physical Indexes

What are Physical Indexes?

Physical Indexes allow you to create specialized query spaces for specific log data based on custom filters you define. By narrowing the search scope, these indexes significantly improve performance for queries targeting specific data subsets.

While Last9’s core value comes from providing correlated telemetry across your entire dataset, there are scenarios where isolating certain data can improve performance and workflow efficiency.

When to Use Physical Indexes

Physical Indexes are most valuable when:

1. Team or Environment Isolation: Separate production from staging data, or create team-specific indexes in organizations with siloed responsibilities.

2. Service-Specific Workflows: Create separate indexes logs from services that don’t typically require correlation within themselves or with other systems (like CDN logs, proxy logs).

3. High-Volume Data Management: Create dedicated indexes for extremely high-volume services that might otherwise impact query performance.

4. Specialized Analysis: Support focused workflows for security events, authentication logs, or error tracking.

Creating a Physical Index

1. Navigate to Physical Indexes and click “New Physical Index”
2. Define filters to determine which logs will be included:
   • Logs are currently the only supported telemetry type
   • Configure filter conditions using attributes or resource attributes. You can also enter a custom attribute when it is not in the suggestions.
   • Use == for an exact value, != to exclude an exact value, or =~ for a regular expression.
   • Multiple filter rows are combined with AND. For example, service.name == "checkout" and deployment.environment == "production" includes only production checkout logs.
   • To include multiple values of the same attribute, use one =~ filter rather than multiple rows. For example, use resource.attributes["service.name"] =~ "^(payment-service|billing-service|invoice-service)$" to route those three services to one index.
   • Click on “View Logs” to confirm your filter works as expected
3. Specify index details:
   • Retention period matches your organization’s default retention, but can be changed by contacting support
   • Give a descriptive name using letters, numbers, and underscores (cannot be changed after creation)
   • Add an optional description (see naming best practices)
4. Click “Create Physical Index”

Index Naming Best Practices

While there are no strict rules for naming indexes, consider these patterns for clarity and organization:

• Environment-based: prod-logs, staging-logs, dev-logs
• Team-based: team-payments, team-auth, team-frontend
• Service-based: service-cdn, service-api, service-db
• Purpose-based: security-events, error-logs, performance-metrics

Important Considerations

1. Correlation Trade-offs: Physical Indexes create separate query spaces. While this improves performance for targeted queries, it may limit correlation capabilities across your entire dataset.

2. Retention Periods: Physical Indexes share the same retention period as your organization’s default index. To modify retention for a specific index, contact support.

3. Filter Design: Create precise filters to include only the data you need. Overly broad filters may reduce the performance benefits of separate indexes.

4. Multiple Values: OR, IN (...), and comma-separated values are not supported between filter rows. Use an anchored regex with =~ for an allowlist of values on one attribute.

Example Use Cases

Environment Separation

Create separate indexes for production and non-production environments:

Filter: resource.attributes["k8s.namespace.name"] =~ "^production-.*$"
Name: prod-environment

Team-Specific Indexes

Isolate data for team-specific workflows:

Filter: resource.attributes["service.name"] =~ "^(payment-service|billing-service|invoice-service)$"
Name: team-finance

High-Volume Service Isolation

Create dedicated indexes for services generating large volumes of logs:

Filter: resource.attributes["service.name"] == "cdn-edge"
Name: high-volume-cdn

Security Monitoring

Isolate authentication and security events:

Filter: attributes["log.level"] =~ "^(ERROR|CRITICAL)$"
Filter: attributes["event.type"] =~ "^(auth|security)$"
Name: security-events

Multiple Services in One Index

To route a fixed set of services to one Physical Index, add one filter:

Attribute: resource.attributes["service.name"]
Operator: =~
Value: ^(catalog|checkout|payments)$

The ^ and $ anchors ensure that the pattern matches whole service names. Do not add one == filter row per service: rows are evaluated with AND, so a log cannot match two different service names at once.

Troubleshooting

Please get in touch with us on Discord or Email if you have any questions.