What is better for performance - make 30 shards in index => ["prod-%{+YYYY.MM}"] or daily index like index => ["prod-%{+YYYY.MM.dd}"]?
P.s. I plan to use ELK for storing app logs for 2-3 years
P.p.s. Approximate amount of unziped logs now is 30GB/day
I would just use daily and make it a single shard.
if use SSD a single shard if not two or three shards .
as my test HHD 30G is two large 10G -15G is better.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.