Topic starter
19/08/2026 3:54 pm
TL;DR: Facet-based search shifts observability from raw-text scanning to indexed field lookups, which can materially reduce query time and compute cost at petabyte scale, according to Edge Delta. The governance question is not whether facets help, but how teams structure telemetry early enough to keep search usable as data volumes and enrichment grow.
Editorial analysis by NHI Mgmt Group, based on content published by Edge Delta: “How to Optimize Query Times in Edge Delta with Facets”.
Key questions
Q: How should security teams structure telemetry so searches stay fast at scale?
A: Teams should extract and normalise the fields they query most often before data is indexed.
Q: Why does raw-text telemetry search become expensive in large observability environments?
A: Raw-text search forces the backend to inspect far more data than an indexed field lookup, so every additional log line increases compute and latency.
Q: What do teams get wrong when they add facets too late in the pipeline?
A: They often try to retrofit structure after data is already indexed, which makes the new search dimension harder and more expensive to create.
Practitioner guidance
- Define a facet taxonomy for investigation-critical fields Identify the attributes analysts repeatedly use in triage, such as status code, service name, source IP, region, pod ID, and workload labels.
- Push enrichment before indexing Use telemetry pipelines to parse and enrich data before it reaches the indexed store, so high-value fields are available as facets on arrival.
- Limit raw-text dependence for routine investigation Reserve raw-message scanning for edge cases and use facet filters for common questions like source, status, and service impact.
Bottom line: Facet search reduces query burden by letting analysts filter on indexed attributes instead of scanning raw log text.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:31 pm
Facet governance is now a telemetry architecture issue, not just a search feature. Once observability data is enriched with service, workload, region, and status metadata, the real challenge becomes whether those attributes are structured well enough to stay queryable under load. Teams that treat facets as an afterthought usually discover the problem during incident response, when search latency becomes operational drag. The practitioner lesson is to govern search fields as part of the telemetry design model.
A question worth separating out:
Q: What happens when observability search is not aligned to the data model?
A: Search slows down, query costs rise, and analysts spend more time fighting the dataset than investigating the incident. In practice, that creates a governance gap between what telemetry contains and what the platform can actually filter efficiently.
👉 Read our full editorial: Facet-driven telemetry search cuts query cost at petabyte scale