30 shards or daily index?

Elastic Stack Elasticsearch
1

What is better for performance - make 30 shards in index => ["prod-%{+YYYY.MM}"] or daily index like index => ["prod-%{+YYYY.MM.dd}"]?
P.s. I plan to use ELK for storing app logs for 2-3 years
P.p.s. Approximate amount of unziped logs now is 30GB/day

2

I would just use daily and make it a single shard.

3

if use SSD a single shard if not two or three shards .
as my test HHD 30G is two large 10G -15G is better.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.