Details
-
Task
-
Resolution: Done
-
L3 - Default
-
None
-
None
Description
Currently when getting event counts, we look through the event index and do a complex search and aggregation. Now we have the event sequence index, we could do a cheaper lookup by summing all of the matching documents with the same source
ATs:
- We fetch event counts by reading and summing the event sequences. The count of an event is the sum of all sequence occurrences with that event as its source
- the complex event count reading code and aggregations is removed from the event service and reader
- Prefix search works, and previous prefix mapping configuration on event index is removed