ClickHouse Index Design

ClickHouse uses Primary indices and Data Skipping indices to speed up queries. See the following links for more information:

Primary Index: https://clickhouse.com/docs/en/optimize/sparse-primary-indexes

Data Skipping Index: https://clickhouse.com/docs/en/optimize/skipping-indexes

Other helpful links:

https://clickhouse.com/docs/en/concepts/why-clickhouse-is-so-fast

 

In ClickHouse, the following event attributes are configured as Primary and data Skipping indices.

Primary Indices:

• phCustId (Organization ID)
• eventType (Event Type)

Data Skipping Indices:

• reptDevIpAddr (Reporting IP)
• reptDevName (Reporting Device Name)
• customer (Organization Name)
• eventId (Event ID)
• phEventCategory (System Event Category)
• collectorId (Collector ID)
• srcIpAddr (Source Ip Address)
• destIpAddr (Destination Ip Address)
• destIpPort (Destination TCP/UDP Port)
• user (User)
• hostIpAddr (Host Ip Address)
• hostName (Host Name)
• fileName (File Name)
• procName (Process Name)
• appName (Application Name)