Prefered ingest formating for performacne

Is there any performance read benefit to either of these two variants of ingesting data. Meaning will the way they are ingested impact the performance when extracting more of the data, such as “get the mean rtt for all probes”, or “find all probes who have ttl of 22”.

Way A

ping,probe=probe09,target=google.com ttl=54,rtt=2.79,loss=0 $time

Way B

ping_rtt,probe=probe09,target=google.com _value=2.79 $time
ping_ttl,probe=probe09,target=google.com _value=54 $time
ping_loss,probe=probe09,target=google.com _value=0 $time

Meaning one value pr entry pr bucket, or all the “correlating” values within the same bucket.

Hello @eriktar,
For Way A
For get mean for all probes
Assuming you have multiple probes, you’ll have to perform an empty group() to group all data from all probes into one table to find the mean.

For find all probes who have ttl of 22
You’ll have to filter for measurement = ping and then filter for ttl>22 and optionally use limit(n:1) to get just one value for each probe or unique()

For Way B
For get mean for all probes
Yould have to join all the probes together since they’re in different measurements/tables to get the data in the same table, before being able to apply a mean across all the data. For this reason I suggest Way A.

For find all probes who have ttl of 22
This would be a simple filter for measurement = ping_rtt and value > 22
But again because of the mean issue go with WAY A → WINNER

Thanks for the feedback @Anaisdg. Then we will continue with Way A.